Skip to content

Keep SAML Identity when deprovisioning via SCIM

Jessie Young requested to merge jy-scim-identity into master

What does this MR do and why?

  • Currently on SCIM deprovision we remove the user's SAML identity and set the SCIM identity to active: false. But this means that if a user is reprovisioned they have no SAML identity and they cannot sign in. For enterprise users without a local GitLab database password lose access to their account and it cannot be reprovisioned/associated properly.
  • This is behind a feature flag so that we can quickly roll it back if there is a problem.
  • #379149 (closed)

Screenshots or screen recordings

Screenshots are required for UI changes, and strongly recommended for all other merge requests.

How to set up and validate locally

  1. Enable the
  2. Set up SCIM
  3. Set up SAML
  4. SCIM deprovision a user
  5. User's SAML Identity should still be in the database

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Jessie Young

Merge request reports