chiefonboarding / ChiefOnboarding

Free and open-source employee onboarding platform. Onboard new hires through Slack or the web portal.
https://chiefonboarding.com
GNU Affero General Public License v3.0
661 stars 122 forks source link

Bug with SSO and email case sensitivity #337

Closed vakninr closed 1 year ago

vakninr commented 1 year ago

Hi, We had issue with some emails when we tried to login with the SSO with Azure. After investigation we found that in the DB those users were provisioned with lowercase email (even that in Azure it has some upper case). I'm aware that from email perspective it doesn't matter but in the user_auth model in the SSO there is line (https://github.com/chiefonboarding/ChiefOnboarding/blob/master/back/user_auth/views.py - line 282)

user, created = get_user_model().objects.get_or_create( email=user_info["email"]

This function check the email for existence but in case the email is transferred in uppercase it can't find the match and tries to create a new user, which return in exception from the DB that the email exist (violation of the email being unique).

There are multiple ways to solve it I guess but the easiest way I think is just to turn the function to insensitive. (found this - https://stackoverflow.com/questions/64263402/django-model-objects-get-case-insensitivity) if it helps.

If I will have the time I will do PR for it next week... Thanks

GDay commented 1 year ago

Thanks for reporting this. I would prefer to use lower() on the email that is incoming, just to keep the Chief database clean (only lower case emails in there).

A PR would be great! Thank you.