search

awslabs / ssosync

Populate AWS SSO directly with your G Suite users and groups using either a CLI or AWS Lambda
Apache License 2.0
512 stars 175 forks source link

Name Handling #200

Closed CarlosCuevas closed 2 months ago

CarlosCuevas commented 2 months ago

Names don't always fit into the first and last convention.

For example, some people prefer to go by a mononym. The way to accommodate this, in many systems, is passing a zero width space as the last name (or some other character). At present, if a name with a zero width space is pulled from Google, it will cause an API failure when trying to create the user in AWS. It would be helpful to have the option of passing in a non-alphabetic character in one of the name fields (or whatever option that allows us to accommodate folks whose names don't fit into the first and last paradigm).

ChrisPates commented 2 months ago

So you are looking for if either name field is zero length replacing that filed with " " before calling the SCIM API on the AWS side?

CarlosCuevas commented 2 months ago

i think that would work

CarlosCuevas commented 2 months ago

with the caveat that the name wouldn't be zero length when its first pulled from google (since it has the zero width space)

ChrisPates commented 2 months ago

So having investigated, neither Google Workspace directory nor AWS IAM Identity Store, accept an empty first name or last name.

Realistically, this is a very specific corner case.

To test this scenario the following website zerowidthspace.me, provides the means to test this.

CarlosCuevas commented 2 months ago

the AWS API does not accept an empty name but it did seem to accept a name with a zero width space. the tool itself seems to strip it out before sending it? but i'd defer to you on that, of course