Skip to content

Draft: Ensure Group SAML identity linker compares case-insensitively

Drew Blessing requested to merge dblessing_group_saml_linker_case into master

What does this MR do and why?

Describe in detail what your merge request does and why.

Support identified a few issues with customer's signing in via Group SAML. When the case of the stored Identity#extern_uid was different than the case of the NameID sent by the SAML IdP, GitLab would try to update the extern_uid. When email address doesn't match for the fallback this creates a problem for users - they're unable to sign-in and they get the message the SAML ID and email don't match.

The above behavior was corroborated via Audit logging in Kibana. I could see many cases of GitLab trying to update when the only difference was case.

This change ensures we're case-insensitively comparing extern_uid and makes it a public method on Identity so it can be re-used in the future.

Screenshots or screen recordings

Screenshots are required for UI changes, and strongly recommended for all other merge requests.

How to set up and validate locally

Numbered steps to set up and validate the change are strongly suggested.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Drew Blessing

Merge request reports