JIT does not update group when group ID case differs from CMN_SEC_GROUPS.GROUP_CODE, removes the manually assigned group on next login
search cancel

JIT does not update group when group ID case differs from CMN_SEC_GROUPS.GROUP_CODE, removes the manually assigned group on next login

book

Article ID: 449787

calendar_today

Updated On:

Products

Clarity PPM SaaS Clarity PPM On Premise

Issue/Introduction

In the SSO Just-In-Time, the lookup that resolves an asserted group value to a Clarity group is case-sensitive. When the IdP asserts a group value whose character case differs from CMN_SEC_GROUPS.GROUP_CODE, that group silently fails to resolve and is dropped. If added manually, it would be removed on next login. The user authenticates successfully and all other groups sync normally, so nothing indicates what the issue is.

STEPS TO REPRODUCE:

  1. Connect to Clarity on Oracle or PostgreSQL with SAML and JIT provisioning enabled and group mappings configured in the assertion.
  2. In Clarity, create an active global security group with a mixed-case GROUP_CODE, for example ZCorpFinConf.
  3. Configure the IdP so the user_groups claim asserts that group in a different character case, for example zcorpfinconf, alongside one other group whose case matches correctly.
  4. Log in through SSO as a user in that AD group.
  5. Check the user's group membership under Administration - Resources.
  6. Now assign the ZCorpFinConf group to the user manually in Clarity, save, and log in through SSO again. Check the group membership once more.

Expected Results: The ZCorpFinConf group resolves regardless of character case and is applied to the user. If assigned manually it is not silently removed.

Actual Results: The other groups are applied but ZCorpFinConf is not and no error. At step 6 the manual assignment is removed on the next login and not added back, so the group cannot be maintained manually. With debug logging enabled we can see the message:
Group 'zcorpfinconf' not found.

Environment

Clarity 16.4.1 with JIT 2.0

Cause

DE209751

Resolution

  • Review and it's set by design (Not A Bug)
  • Clarity allows group with mismatched ID. Change the Clarity GROUP_CODE to match the case in IDP
  • Additional logging added to expose the exact ERROR without DEBUG in 16.4.2
Powered by Wolken Software