CiviGroup Roles Sync no longer two-way

[nickholden]

Up until a recent upgrade (we are using 4.5.3 but we are not clear when the problem started) we had CiviGroup Roles Sync working nicely with our drupal / LDAP system.

A user would be added to a specific group in the Active Directory LDAP system. Next time they logged on the drupal LDAP authorization module would add them to the appropriate drupal role, and then the CiviGroup Role Sync would add their contact record to the relevant group in CiviCRM.

But recently this hasn't been happening. New users are provisioned correctly by the LDAP authorization, assigned the relevant drupal role, then civicrm_group_roles runs and notices that the person is not in the equivalent CiviCRM group. Rather than adding them to the group, it deletes them from the drupal role.

Is this now the intended behaviour? Instead of any change at either end of the relationship triggering an equivalent change at the other end, the new version of the module makes CiviCRM group status the 'authoritative' status, and forces drupal role membership to follow that. The presentation of the rule names in the module having a double ended arrow suggests this is not the intention.

Our only solution is to add the contact records to the CiviCRM group manually, which means the CiviGroup Role Sync is useless for us.

If we could get confirmation about the intended behaviour that would be great. If the intention is to provide true two-way synchronisation, then is this a bug?