OAuth location mapping not functional

Summary

This customer is trying to set a user's location via SAML when the user is created on receiving the first SAML response.

This does currently not work as discussed in this Slack thread.

@dblessing found that location is remapped to address in this code https://gitlab.com/gitlab-org/gitlab/-/blame/master/lib/gitlab/auth/o_auth/auth_hash.rb#L41

address however does not seem to be a valid info hash attribute.

Our docs here seem to imply that attributes showing in the info hash doc are supported (from Map SAML response attribute names):

You can use attribute_statements to map attribute names in a SAML response to entries in the OmniAuth info hash. Only use this setting to map attributes that are part of the OmniAuth info hash schema.

@ffarukh and @asmaa.hassan pointed me to the following code https://gitlab.com/gitlab-org/gitlab/blob/002a586a255147e88025e638f2f3265cc4ae535a/spec/lib/gitlab/auth/o_auth/auth_hash_spec.rb#L47-L60

which seems to indicate that we are indeed expecting address instead of location, however here we state that location is syncable - not address.

Steps to reproduce

• Configure SAML (Simple SAML if using GDK) for user authentication
• Attempt to set the user's location using the SAML response upon user creation.

What is the current bug behavior?

• The location attribute in the SAML response does not map correctly to the expected field in GitLab.
• The user's location is remapped to the :address attribute in the OmniAuth info hash, which is not a valid info hash attribute as per documentation

What is the expected correct behaviour?

• Like other attributes like email, the location attribute should be able to use mapped custom attributes during a user's SAML identity creation

Relevant logs and/or screenshots