Contrib.social

Email address and user name are not populated correctly

Open on Drupal.org →
Created on 4 April 2023, over 1 year ago
Updated 7 July 2023, over 1 year ago

Problem/Motivation

Thanks for the module. Very good user experience.
I came across an issue, in which the user name and email address weren't populated as they are in the IDP database.
The new user name and email address created by Drupal are the same as for example '_78575d6a4be88b303ea30ac7b1cddbd999e4eb8f43'.
In the Drupal log, following log message are created.

SAML login attempt with inbound ID: ONELOGIN_5b51da7c8b9361d0214e50620185f06bfc863922

New SSO user account for _894e0f7d49d7383c7944d971ed4ddb6da69dc7318b with UID 3.

User _894e0f7d49d7383c7944d971ed4ddb6da69dc7318b logging in through SAML via docker. with NameID _894e0f7d49d7383c7944d971ed4ddb6da69dc7318b and attributes Array ( [email] => Array ( [0] => user2@example.com ) )

In the last log, the 'docker' is the IDP name, the user email is 'user2@example.com'.

Steps to reproduce

  1. Install the module by composer
  2. Enable the module.
  3. Create an identity provider named 'docker'
  4. Following the instructions from the readme file to config the IDP and SP
  5. Once all configurations are completed. The SSO works. but the problem is the user name and email address are not populated as IDP provided.

The saml_sp.settings.yml

#...
strict: true
security:
  nameIdEncrypted: true
  authnRequestsSigned: true
  logoutRequestSigned: true
  logoutResponseSigned: true
  wantMessagesSigned: true
  wantAssertionsSigned: true
  wantNameIdEncrypted: false
  signMetaData: true
  signatureAlgorithm: 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256'
  lowercaseUrlencoding: false
#...
new_cert_location: ''
entity_id: ''
valid_until: ''
debug: false
#...

The saml_sp_drupal_login.config.yml

idp:
  docker: docker
logout: false
logged_in_redirect: '<front>'
update_email: false
update_language: false
no_account_authenticated_user_role: true
no_account_authenticated_user_account: null
force_authentication: false
force_saml_only: false
account_request_request_account: true
account_request_create_account: true

The saml_sp.idp.docker.yml

#...
nameid_field: mail
#...
authn_context_class_ref:
  user_name_and_password: user_name_and_password
  password_protected_transport: password_protected_transport
  tls_client: tls_client
  x509_certificate: x509_certificate
  integrated_windows_authentication: integrated_windows_authentication
  kerberos: kerberos

The NameIDFormat in metadata is
<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>

✨ Feature request
Status

Fixed

Version

4.0

Component

Code

Created by

🇦🇺Australia mingsong 🇦🇺

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024