SSO enabled users' roles unchangeable in teams

[tmahncke-lhind]

Current Behavior

When a SSO enabled user is in a team with a specific role it is not possible to change the role. There is no UI feedback, but the reqest returns with a 400. It is also not possible to remove the user, nor to re-invite them.

This makes user administration on team level practically unusable, e.g. promoting a member to owner when the current owner leaves.

The only way we found to fix this is to delete the user as flowfuse admin and re-create it with a new login, but that is not reasonable for a user that has multiple teams and needs to be re-added everywhere.

Modification fails

Deletion fails

re-invite fails

Expected Behavior

• If there is an issue with the underlying request the UI should show it and not fail silently
• There should be a possibilty to change roles inside a team for SSO users

Steps To Reproduce

• Add a team member with SSO to the team in any role
• Open dev tools
• Try to change the role or remove the user from the team

Environment

• FlowFuse version: 2.28.0
• Node.js version: 20.20.1
• npm version: 10.8.2
• Platform/OS: Windows
• Browser: Firefox 148.0.2 (64-Bit)

Have you provided an initial effort estimate for this issue?

I am not a FlowFuse team member

[hardillb]

Can you please confirm how SSO is configured?

• SAML or LDAP
• Are you using group membership in the SSO configuration to set team roles?

[tmahncke-lhind]

• SAML
• Do you mean "Manage roles using group assertions"? Then yes. I checked the documentation and that is probably the issue, right?

[hardillb]

Yes, if team roles are managed by the group assertions then you can not change them in the app, the SSO is the single source of truth

[hardillb]

That being said the UI should make this clear.

[tmahncke-lhind]

Maybe the system could make this more present, e.g. by not even allowing the options for SSO users. But we can fix the issue on our end.

[hardillb]

Just a note, users will need to log out and back in for group membership changes to take effect

[knolleary]

We should make this clearer in the UI and disallow such changes to users with SSO group membership enabled.

As it stands, I believe the front-end will know they are an SSO user, but it will not know their team membership is SSO managed.

This will require:

• add a flag to the User object to indicate whether its team memberships are SSO managed. We already have the SSOGroups property that is only set if the option is enabled to expose membership to dashboard logins. Can we reuse that somehow whilst retaining the exposeGroups option?
• add the flag on the api schema so the frontend receives it
• update UX for changing role to prevent changes, with appropriate hint on why its disabled