Hi opkar, yes i implemented the same, one thing i noticed from log is org.apache.jackrabbit.oak.spi.security.authentication.external.impl.DefaultSyncHandler Membership of user 'user-a' need sync. rep:lastSynced not set.I don't see the request for Group sync in the log just like for userorg.apache...