SSO Custom User Provisioning - Remove and Replace Roles

0
Hi All, We’re using the SAML module with a custom Java action inside our `Custom User Provisioning` microflow per the SAML module. We’ve created this in a separate module, SAML_Customizations, so that we can keep the module up to date without losing our custom logic. The microflow receives the XML from our IdP and splits it out into a comma-separated list that matches the Project Security roles we have in Mendix. It retrieves all roles, iterates through, and adds a new role wherever it finds a match. What I cannot figure out how to solve, however, is the best way to deal with role changes that are not additions, e.g. for users who may be demoted, in which case they would lose privileges. I was thinking the best way to start would be to find all roles for the user and delete them, but this ended up breaking our SSO completely. Am I on the right path here? Should I have a decision to see if the user exists and then proceed from there? Should I put it within one of the iterations? Appreciate any help and guidance you all can provide. Please note we are on 8.11 but it was not available in the dropdown selector. Thanks! Chris
asked
1 answers
3

Instead of deleting the user role objects (bad because there is only one copy of each roles in the database), you should be removing them from association between User and UserRole. So, in the provisioning microflow, before you loop through and add user roles for a user, do a “Change Object” action and Set the association UserRoles to empty.

answered