mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-02-06 00:59:39 +03:00
Role assigning issue when someone login using SSO first time #3965
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @archit0001 on GitHub (Aug 11, 2023).
Attempted Debugging
Searched GitHub Issues
Describe the Scenario
Recently, I created a new Bookstack on Ubuntu VM on AWS and I set SSO with Microsoft Azure.
After creating the instance I used one of my Booksatack instance's database and restore my new Bookstack instance for trial at that time I set role Editor to be set when someone login the first time and it was working at that time.
after I made my last migration to the new Bookstack instance and now I have done the same config on the new Bookstack but when someone login using SSO no role is being set to any user despite having the Editor role selected for "Default user role after registration" in Registration setting.
Please give me suggestions on what I can do.
Thank you.
Exact BookStack Version
BookStack v23.06.1
Log Content
No response
PHP Version
8.1.2
Hosting Environment
Ubuntu 22.04.2 LTS, using the official installation script
@archit0001 commented on GitHub (Aug 11, 2023):
Just to mention i have used this config in .env
AUTH_METHOD=saml2
SAML2_NAME="Microsoft"
SAML2_EMAIL_ATTRIBUTE=
SAML2_EXTERNAL_ID_ATTRIBUTE=
SAML2_DISPLAY_NAME_ATTRIBUTES=
SAML2_IDP_ENTITYID=
SAML2_IDP_SSO=
SAML2_IDP_SLO=
SAML2_IDP_x509="-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----"
Just for clarification, i have also added all the required information in the config i mentioned and SSO is working completely.
Thank you.
@ssddanbrown commented on GitHub (Aug 12, 2023):
When testing on the new instance, is this the user's first login, where their account/email did not even exist in the system before and they had no pre-existing roles assigned?
The default role should be assigned if the user has to be created in the system, but it won't be assigned if the user account pre-exists.
@archit0001 commented on GitHub (Aug 12, 2023):
When I was testing, there were some accounts but those users who were trying to use the email addresses were not there before.
I assume Bookstack uses email id as a unique id to identify whether the user account exists or not?
If the answer is yes then, when users login the first time with a non-existing email address on the Bookstack instance, it should assign the role I set for the first-time login users.
@ssddanbrown commented on GitHub (Aug 13, 2023):
Kind of. It will de-dupe on email but the SAML2 auth won't match on email, BookStack will use the ID attribute (as per the
SAML2_EXTERNAL_ID_ATTRIBUTEsetting) to match users.Microsofton the login page?@archit0001 commented on GitHub (Aug 15, 2023):
"Again, just to clarify things, can you test via logging in with a completely 100% fresh user account (using an email that's never existed in the system) to confirm if they are assigned the chosen role?"
Yes, I did test with a 100% fresh account but it's still not picking the editor role.
"Also, are you initiating the login from a button only labeled Microsoft on the login page?"
Yes, I am initiating the login from a button labeled "Login with Microsoft" on the login page.
@archit0001 commented on GitHub (Aug 18, 2023):
I figured out what the issue was.
After migrating the new Boosktack instance the permissions on,
storage/
bootstrap/cache
public/uploads
was not set correctly. I don't know how it was changed.
After changing the permission I am getting the default assign role on the new users.
So I would definitely recommend everyone to check whether permissions are set or not because it would solve most of the problems.
Thank you.