From 34e9af57fed754e33d3b4bd2115f6e68b1491d4b Mon Sep 17 00:00:00 2001 From: Jens L Date: Thu, 20 Apr 2023 19:47:41 +0300 Subject: [PATCH] website/integrations: switch default gitlab name identifier (#5321) Signed-off-by: Jens Langhammer #5312 --- website/docs/providers/saml/index.md | 6 +++++- website/integrations/services/gitlab/index.md | 2 +- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/website/docs/providers/saml/index.md b/website/docs/providers/saml/index.md index d4192f42c..0683ceb76 100644 --- a/website/docs/providers/saml/index.md +++ b/website/docs/providers/saml/index.md @@ -22,8 +22,12 @@ The metadata download link can also be copied with a button on the provider over You can select a custom SAML Property Mapping after which the NameID field will be generated. If left default, the following checks are done: -- When the request asks for `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress`, the NameID will be set to the user's email address. - When the request asks for `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent`, the NameID will be set to the hashed user ID. - When the request asks for `urn:oasis:names:tc:SAML:2.0:nameid-format:X509SubjectName`, the NameID will be set to the user's `distinguishedName` attribute. This attribute is set by the LDAP source by default. If the attribute does not exist, it will fall back the persistent identifier. - When the request asks for `urn:oasis:names:tc:SAML:2.0:nameid-format:WindowsDomainQualifiedName`, the NameID will be set to the user's UPN. This is also set by the LDAP source, and also falls back to the persistent identifier. - When the request asks for `urn:oasis:names:tc:SAML:2.0:nameid-format:transient`, the NameID will be set based on the user's session ID. +- When the request asks for `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress`, the NameID will be set to the user's email address. + + :::warning + Keep in mind that with the default settings, users are free to change their email addresses. As such it is recommended to use `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent`, as this cannot be changed. + ::: diff --git a/website/integrations/services/gitlab/index.md b/website/integrations/services/gitlab/index.md index e446d0408..0015330f1 100644 --- a/website/integrations/services/gitlab/index.md +++ b/website/integrations/services/gitlab/index.md @@ -51,7 +51,7 @@ gitlab_rails['omniauth_providers'] = [ idp_cert_fingerprint: '4E:1E:CD:67:4A:67:5A:E9:6A:D0:3C:E6:DD:7A:F2:44:2E:76:00:6A', idp_sso_target_url: 'https://authentik.company/application/saml//sso/binding/redirect/', issuer: 'https://gitlab.company', - name_identifier_format: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress', + name_identifier_format: 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent', attribute_statements: { email: ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'], first_name: ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name'],