getsentry / getsentry/sentry

SAML2 : Cannot link existing user to IDP account

Open
#54,634 12 comments 1 reaction 0 assignees View on GitHub
Improvement Product Area: Settings - Auth
Dominant language
Python
Stars
44.8k
Forks
4.9k
Avg merge
1d 5h
Merged PRs (30d)
624

Description

### Self-Hosted Version

23.5.1

### CPU Architecture

x86_64

### Docker Version

24.0.1

### Docker Compose Version

2.18.1

### Steps to Reproduce

1) Create a user account (not admin) with an email address
2) Configure SAML Login to a generic SAML2 IDP (DUO Security)
3) Click on the link in the email:
![image](https://github.com/getsentry/self-hosted/assets/24651698/f90b20ce-2dbe-4744-aa50-a33335fe7744)
4) Click on the `Login with SAML2` button
5) Login with IDP

### Expected Result

I expect to be able to login with my old account and link it to the IDP identity.

In our company, we have mail alias in the following format:

- `.@vnv.ch`
- `.@vnv.ch`

Using my e-mail, that would be m.pedretti@vnv.ch and mael.pedretti@vnv.ch.

If my sentry account is created with mael.pedretti@vnv.ch and the email in the IDP is m.pedretti@vnv.ch, I won't be able to link it.

The admin setting everything up can link any account to any IDP identity but not the end user if he is disconnected.

### Actual Result

A new account is created without ever asking to link account.

![image](https://github.com/getsentry/self-hosted/assets/24651698/e06ef009-0498-4fee-87ca-b59da334c1f6)

### Event ID

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.