search

SecurityRiskAdvisors / VECTR

VECTR is a tool that facilitates tracking of your red and blue team testing activities to measure detection and prevention capabilities across different attack scenarios
1.35k stars 159 forks source link

Users aren't merged after enabling SSO #191

Closed nonsleepr closed 1 year ago

nonsleepr commented 1 year ago

Describe the bug The local account user and SSO (OIDC) user with same usernames aren't merged. This prevents the user to log in with password (and with SSO until approved by admin). It's impossible to delete or change permissions of the user afterwards (users are identified by username in REST requests).

To Reproduce Steps to reproduce the behavior:

  1. Go to "Access Management / Users"
  2. Create a new user with username "test_user"
  3. Confirm that the new user can log in
  4. Configure SSO connection
  5. Log in as "test_user" using SSO
  6. Attempt to log in as "test_user" using password; Observe an error
  7. Log in as Admin and approve "test_user" logged in with SSO
  8. Log in as "test_user" using SSO (it should work as expected)
  9. As an Admin, attempt to delete or edit "test_user"; Observe 500 error in DevTools

Expected behavior The users with the same username should be considered either different entities or merged into a single account.

Vectr Comunnity version: v8.4.3

SRAPSpencer commented 1 year ago

Thanks for reporting, this is a known issue internally. We'll update this when resolved.

doodleincode commented 1 year ago

This has been addressed in ce-8.6.1.