You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Prevent null or empty username creation during SAMP IdP brokering with missing attributes
#44665
We have noted a bug where users are created with null or empty usernames when SAML identity provider attribute mappers reference attributes that are missing from the IdP response. This results in unusable user accounts that cannot be deleted from the Admin Console due to database foreign key constraints.
When a SAML identity provider is configured with a username template mapper (e.g., ${ATTRIBUTE.username}) that references an attribute not present in the SAML response, the system creates a user with a null or empty username. This causes several issues:
Invalid user records persist in the database.
Users cannot be deleted from the Admin Console (FK constraint violations on federated_identity and user_role_mapping tables).
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
We have noted a bug where users are created with
nullor empty usernames when SAML identity provider attribute mappers reference attributes that are missing from the IdP response. This results in unusable user accounts that cannot be deleted from the Admin Console due to database foreign key constraints.When a SAML identity provider is configured with a username template mapper (e.g.,
${ATTRIBUTE.username}) that references an attribute not present in the SAML response, the system creates a user with anullor empty username. This causes several issues:federated_identityanduser_role_mappingtables).Related issues: #44149, #44598, #44149
The bug occurs due to a gap in validation logic across the identity brokering flow. I have proposed a PR: #44664
All reactions