[bickelj-agent]

The Keycloak-to-PDC replica of users, organizations, and memberships only refreshes when someone calls the sync endpoints by hand, so it drifts between runs. Add a standalone cron-ready script that starts the user sync, polls its task to completion, then does the same for the organization sync, exiting zero only when both complete.

Refs PhilanthropyDataCommons/service#2600

GLM-5.3-Flash, an LLM supervised and prompted by @bickelj

[Copilot]

🟡 Changes recommended

A critical active issue remains because retrying non-idempotent sync-start POSTs after lost responses or transient failures can create duplicate synchronization tasks.

1 open issue

• Avoid retrying non-idempotent sync-start POSTs · New

What changed in this PR

Adds a standalone, cron-ready utility that authenticates with Keycloak and synchronizes PDC users and organizations through sequential asynchronous API tasks.

Changes:

• Adds OAuth2 client-credentials authentication using environment-provided credentials.
• Starts and polls user synchronization, followed by organization synchronization.
• Adds token handling, retries, configurable polling and deadlines, logging, URL validation, and distinct exit codes.

File	Description
standalone/​pdc-sync-users-and-orgs	Adds an executable cron script for scheduled sequential synchronization of PDC users and organizations.

_{Review effort: Lite}