Identity groups not properly cleaned/merged with identity/entity/merge request

[mdgreenfield]

Describe the bug
Assume there are two entities, toEntity and fromEntity. fromEntity is a member of groupA. If fromEntity is merged into toEntity a success message is returned. However, there are several problems:

1. groupA does not have the fromEntity ID removed from member_entity_ids. Trying to update groupA's name only results in an error.
2. toEntity does not have its direct_group_ids updated to include the groupA ID of fromEntity.

To Reproduce
Steps to reproduce the behavior:

1. Run vault server -dev
2. Create fromEntity - fromEntity=$(vault write -field=id identity/entity name=child)
3. Create toEntity - toEntity=$(vault write -field=id identity/entity name=parent)
4. Create groupA - groupA=$(vault write -field=id identity/group name=groupA member_entity_ids=$fromEntity)
5. Merge fromEntity into toEntity - vault write identity/entity/merge to_entity_id=$toEntity from_entity_ids=$fromEntity
6. Update groupA name to updatedGroupA - vault write identity/group/id/$groupA name=updatedGroupA. Observe this results in the following error:

   Error writing data to identity/group/id/08dabd46-bfa9-8bc1-ce15-1a154e9fa50a: Error making API request.
   
   URL: PUT http://127.0.0.1:8200/v1/identity/group/id/08dabd46-bfa9-8bc1-ce15-1a154e9fa50a
   Code: 500. Errors:
   
   * 1 error occurred:
           * invalid entity ID "ff767f9f-aa78-a4c0-98f8-f1bf1548ab66"
   

7. Fetch groupA member entity ID - groupA_member_id=$(vault read -field=member_entity_ids -format=json identity/group/id/$groupA | jq -r '.[0]')
8. Read the member entity ID and observe it does not exist - vault read identity/entity/id/$groupA_member_id
9. Read the group IDs linked to toEntity and observe that the group IDs are valid - vault read -field=group_ids identity/entity/id/$toEntity

Expected behavior
The groupA member_entity_ids should not contain an effectively deleted entity ID and merged entities should have their groups merged into the parent entity.

Environment:

• Vault Server Version (retrieve with vault status): 1.5.4
• Vault CLI Version (retrieve with vault version): 1.5.4

Additional context
Whether or not groups should get merged into the toEntity I'm less sure about because when identity/entity/merge is called policies are not merged. However, it does look like policies maybe get merged when an implicit entity is created on login.

• Link to the mergeEntity func
• Related PR

[hghaf099]

Waiting for response in the PR