cloudfoundry / cloudfoundry/uaa

Configuration to Not to allow IDP to update UAA User

Open
#3,281 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Java
Stars
1.6k
Forks
844
Avg merge
2d 5h
Merged PRs (30d)
27

Description

We are using UAA 76.5 version (with PostgreSQL) and have integrated with Azure B2C as the Identity provider.
The authentication works fine but the problem is on getting the callback from B2C to UAA --> user attributes family_name and given_name gets updated in UAA (that we do not want).

We have other process to update the user profiles in UAA , and we do not want any user data to get updated as part of authentication process via IDP integration. Email is the only common attribute Azure B2C and UAA user profile. Azure B2C - does not hold any family name or given name information and thus when call back happens - in UAA - user`s family_name and given_name gets set to NULL.

Please advise if there is any configuration we can use in yml to achieve this ? Below is our login.yml configuration

microsoftb2c:
type: oidc1.0
authUrl: https://testabccppd.onmicrosoft.com/oauth2/v2.0/authorize?p=b2c_122_signinup_en
tokenUrl: https://testabccppd.onmicrosoft.com/oauth2/v2.0/token?p=b2c_122_signinup_en
tokenKeyUrl: https://testabccppd.onmicrosoft.com/discovery/v2.0/keys?p=b2c_122_signinup_en
issuer: https://testabccppd.onmicrosoft.com/*******/v2.0/
scopes:
- openid
responseType: code
addShadowUserOnLogin: false
relyingPartyId: ******************
skipSslValidation: true
attributeMappings:
user_name: extension_username

Thanks for your help.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Begin with the login.yml microsoftb2c provider and its attributeMappings, then trace the OIDC callback path that updates the UAA user. Determine whether configuration can preserve existing family_name and given_name values while matching on email; done means a supported setting is identified and verified, or the limitation is clearly documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, java, postgresql
Domain
authentication, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.