You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository was archived by the owner on Apr 26, 2024. It is now read-only.
Currently Open ID mapping providers have no method of checking for an existing user localpart when mapping user attributes received from the external service over to matrix.
This can be a problem for e.g some services that identify users via an email address, but also allow custom domains. As the localpart of email addresses can be the same (alice@example.com, alice@example2.com), if the mapping provider wishes to only take the localpart of the email address and use it as the Matrix localpart, there will be a conflict.
SAML mapping providers can overcome this using the failures integer argument to the saml_response_to_user_attributes function. If the localpart returned by the mapping provider maps to an existing Matrix localpart, saml_response_to_user_attributes will be called again with the failures argument incremented.
SAML mapping providers can use this as a sign to change the localpart slightly before returning again. This process continues until a valid, new localpart is generated, or an arbitrary loop limit is hit.
OIDC mappers do not have similar functionality, and thus mapping provider developers are stuck.
It's worth nothing that this problem could be solved by append random characters to the localpart, thus making a collision unlikely, but it is not a very elegant solution.
I'm also aware that the SAML failures solution only gives limited information to the mapping provider, and would consider a different approach. However, whatever is decided on should be made consistent across both SAML and OIDC for ease of development and use.