-
Bug
-
Resolution: Unresolved
-
Low
-
None
-
4.1.11
Issue Summary
For any JIT user, when they are disabled in Jira, if the authentication is successful (at IDP), the attributes will be updated, in Jira, after authentication and they will not be allowed to login
Steps to Reproduce
- Setup SSO with SAML in Jira.
- Enable JIT.
- Login with a user account which does not exist in Jira.
- Once the user is created in Jira internal directory, disable it.
- Make changes to one of attribute for the user account in LDAP, say FirstName or Email.
- Login to Jira using this disabled account.
- Jira will block access of the user, however, the updated attribute from LDAP will be synced in Jira.
Expected Results
A disabled user should not get updated.
Actual Results
Jira will block access of the user, however, the updated attribute from LDAP will be synced in Jira
The below exception is thrown in the atlassian-jira.log file:
2021-12-17 14:46:20,094+0530 https-jsse-nio-8851-exec-4 ERROR anonymous 886x1240x1 1dqukzq 0:0:0:0:0:0:0:1 /plugins/servlet/samlconsumer [c.a.p.a.i.web.filter.ErrorHandlingFilter] Received SSO request for user jituser@dsidhpura.lab, but the user does not exist com.atlassian.plugins.authentication.impl.web.usercontext.AuthenticationFailedException: Received SSO request for user jituser@dsidhpura.lab, but the user does not exist at com.atlassian.plugins.authentication.impl.web.saml.SamlConsumerServlet.lambda$doPost$0(SamlConsumerServlet.java:107) at java.util.Optional.orElseThrow(Optional.java:290) at com.atlassian.plugins.authentication.impl.web.saml.SamlConsumerServlet.doPost(SamlConsumerServlet.java:107) at javax.servlet.http.HttpServlet.service(HttpServlet.java:652) at javax.servlet.http.HttpServlet.service(HttpServlet.java:733) at com.atlassian.plugin.servlet.DelegatingPluginServlet.service(DelegatingPluginServlet.java:37) at javax.servlet.http.HttpServlet.service(HttpServlet.java:733) at com.atlassian.plugin.servlet.ServletModuleContainerServlet.service(ServletModuleContainerServlet.java:46) at javax.servlet.http.HttpServlet.service(HttpServlet.java:733) ... 48 filtered at com.atlassian.jira.plugin.mobile.web.filter.MobileAppRequestFilter.doFilter(MobileAppRequestFilter.java:59) ... 4 filtered at com.atlassian.jira.plugin.mobile.login.MobileLoginSuccessFilter.doFilter(MobileLoginSuccessFilter.java:54) ... 3 filtered at com.atlassian.diagnostics.internal.platform.monitor.http.HttpRequestMonitoringFilter.doFilter(HttpRequestMonitoringFilter.java:55) ... 8 filtered at com.atlassian.plugins.authentication.impl.web.filter.ErrorHandlingFilter.doFilterInternal(ErrorHandlingFilter.java:78) at com.atlassian.plugins.authentication.impl.web.filter.AbstractJohnsonAwareFilter.doFilter(AbstractJohnsonAwareFilter.java:29) ... 3 filtered at com.atlassian.web.servlet.plugin.request.RedirectInterceptingFilter.doFilter(RedirectInterceptingFilter.java:21) ... 48 filtered at com.atlassian.plugins.slack.analytics.SlackAnalyticsFilter.doFilter(SlackAnalyticsFilter.java:35) ... 3 filtered at com.atlassian.troubleshooting.thready.filter.AbstractThreadNamingFilter.doFilter(AbstractThreadNamingFilter.java:46) ... 17 filtered at com.atlassian.jira.security.JiraSecurityFilter.lambda$doFilter$0(JiraSecurityFilter.java:66) ... 1 filtered at com.atlassian.jira.security.JiraSecurityFilter.doFilter(JiraSecurityFilter.java:64) ... 36 filtered at com.atlassian.jira.servermetrics.CorrelationIdPopulatorFilter.doFilter(CorrelationIdPopulatorFilter.java:30) ... 5 filtered at com.atlassian.jwt.internal.servlet.JwtAuthFilter.doFilter(JwtAuthFilter.java:37) ... 8 filtered at com.atlassian.web.servlet.plugin.request.RedirectInterceptingFilter.doFilter(RedirectInterceptingFilter.java:21) ... 4 filtered at com.atlassian.troubleshooting.thready.filter.AbstractThreadNamingFilter.doFilter(AbstractThreadNamingFilter.java:46) ... 3 filtered at com.atlassian.web.servlet.plugin.LocationCleanerFilter.doFilter(LocationCleanerFilter.java:36) ... 29 filtered at com.atlassian.jira.servermetrics.MetricsCollectorFilter.doFilter(MetricsCollectorFilter.java:25) ... 25 filtered at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.lang.Thread.run(Thread.java:748)
Workaround
Currently there is no known workaround for this behavior. A workaround will be added here when available
- is cloned by
-
KRAK-4593 Failed to load