mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-02-09 11:19:38 +03:00
SAML Group Sync does not assign roles until first login. #2408
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @EternalDeiwos on GitHub (Oct 1, 2021).
Describe the bug
When a user logs in for the first time this triggers
auth_registerwhich does not assign roles that match the chosen groups attribute, however the user is considered "logged in" immediately after they register.Steps To Reproduce
Steps to reproduce the behavior:
Expected behavior
Roles should be assigned at registration, or the user should be forced to explicitly login after they are registered.
Your Configuration (please complete the following information):
Additional context
Using Keycloak for SAML IdP
@ssddanbrown commented on GitHub (Oct 4, 2021):
Hi @EternalDeiwos,
Generally, the login and register flow for SAML are pretty aligned and run through the same process.
In your instance are email confirmation or domain restriction registration settings active? If so, email confirmation send issues could be something stopping the process before it gets to group syncing.
Might also be worth updating to the latest version of BookStack since there have been changes in authentication. Don't think they're anything that should affect this flow but could be a chance and it's better to debug on an up-to-date version.
@EternalDeiwos commented on GitHub (Oct 4, 2021):
Hey @ssddanbrown,
Neither of those settings are active. I'll update and see if that fixes it but as you say it looks like that portion of code hasn't been touched in a while.
@ssddanbrown commented on GitHub (Nov 25, 2021):
Just come back to this to test and cannot reproduce. SAML-provided roles are assigned upon first login in my testing using a fresh user. Will therefore close this off but feel free to still raise or re-open a fresh issue if you're certain there's an issue on the BookStack side, on the latest release, that's possible for us to address.