[Unleash-server]: customAuthHandler fails to update user

[dev-slatto]

Describe the bug

When creating an instance of the unleash-server with a customAuthHandler, the method userService.loginUserSSO() isn't updating the user if it already exists. By doing console.log() on the user object in the OIDCStrategy we see that the roles scope is updated, but the user in Unleash isn't. If we delete the user from the DB and try to log in again after the user has been deleted, then the access level / role is updated. Note that this is only tested on root roles.

For this use case the Azure AD handler has been used.

Code from the custom auth handler:

passport.use(
    'azure',
    // Check passport azure ad documentation for option details: https://github.com/AzureAD/microsoft-authentication-library-for-js/tree/dev/maintenance/passport-azure-ad#4112-options
    new OIDCStrategy(
      {
        identityMetadata: `https://login.microsoftonline.com/${tenantID}/v2.0/.well-known/openid-configuration`,
        clientID,
        clientSecret,
        redirectUrl: `${host}/api/auth/callback`,
        responseType: 'code',
        responseMode: 'query',
        scope: ['openid', 'email', 'profile'],
        allowHttpForRedirectUrl: true,
      },
      async (iss, sub, profile, accessToken, refreshToken, cb) => {
        console.log('debug user', profile)
        let name = profile.displayName;
        let email = profile._json.email;
        let role = profile._json.roles ? profile._json.roles[0] :  unleash.RoleName.VIEWER
        const user = await userService.loginUserSSO({ 
          email, name, rootRole: role, autoCreate: true 
        })
        cb(null, user);
      }
    )
  );

To clarify we are configuring custom AzureAD roles for the application representing the three base roles in Unleash Admin, Editor and Viewer. So in the let role statement, it's either pulling one of them - and if there is no role assigned it will fall back to the Viewer role as a default.

Steps to reproduce the bug

1. Boot an unleash server
2. Create a custom AzureAD Auth handler
3. Construct the user with the userService.loginUserSSO() and autoCreate: true
4. Log in with one set of permissions assigned.
5. Update the permissions either by assigning a new role in AzureAD or hardcode in something new and restart the local unleash-server
6. Log in again and see that your root role hasn't been updated.

Expected behavior

Unleash don’t look at rootRole when updating. Only when creating. We want Unleash to look at the rootRole when updating as well to catch updates and support PIM solutions.

Logs, error output, etc.

Not any logs, but link to Slack thread: https://unleash-community.slack.com/archives/CGP2MCHPF/p1666621398834659

Screenshots

How the mapping is done in AzureAD

Additional context

No response

Unleash version

4.12.6

Subscription type

Open source

Hosting type

Self-hosted

SDK information (language and version)

No response

[ivarconr]

You could call updateUser in your code if you detect the root role is wrong, to update the rootRole of the user.