FlowFuse / FlowFuse/flowfuse

SSO login fails if no group claim included when expected

Open
#6,528 0 comments 0 reactions 0 assignees View on GitHub
needs-triage type:bug
Dominant language
JavaScript
Stars
400
Forks
89
Avg merge
1d 21h
Merged PRs (30d)
146

Description

### Current Behavior

If an email domain has SSO enabled with managed team membership enabled, but the login claim is missing the group claim, the login will fail.

We have seen a case with Azure where a user was not a member of any group, so the login did not include any group claim and an error was thrown.

For this scenario, I think we should log that no group claim was found (as that's helpful to debug misconfigurations), but if 'allow user to be a member of other teams' is enabled, they should still be able to login and the missing claim treated as an empty list.

### Expected Behavior

User can still login

### Steps To Reproduce

_No response_

### Environment

- FlowFuse version:
- Node.js version:
- npm version:
- Platform/OS:
- Browser:

### Have you provided an initial effort estimate for this issue?

I have provided an initial effort estimate

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.