SAML group sync always adds "Users" group and does not remove it when not present in assertion

[MilanVolf]

Wiki.js version

3.1.1

Authentication provider

SAML 2.0 with SAML Identity Provider (e.g. Microsoft Entra ID)

Description

When using SAML group synchronization, Wiki.js automatically assigns the built-in Users group to newly created users even though this group is not present in the SAML assertion.

Additionally, with "Unassign from groups no longer present in assertion" enabled, the automatically assigned Users group is not removed on subsequent logins.

The intention is to use the SAML identity provider as the authoritative source for group membership.

SAML configuration

• Registration / Self-registration: Enabled
• Assign to groups: Empty
• Map Groups: Enabled
• User Groups Field Mapping: memberOf
• Unassign from groups no longer present in assertion: Enabled

SAML assertion

I verified the actual SAML response sent by SAML Identity Provider (e.g. Microsoft Entra ID).

The assertion contains only the expected group in memberOf, for example:

<Attribute Name="memberOf">
    <AttributeValue>0f000a00-0400-0000-0000-000000000001</AttributeValue>
</Attribute>

There is no Users value/group anywhere in the SAML assertion.

Steps to reproduce

1. Configure SAML authentication with self-registration enabled.
2. Leave "Assign to groups" empty.
3. Enable "Map Groups".
4. Set "User Groups Field Mapping" to memberOf.
5. Enable "Unassign from groups no longer present in assertion".
6. Configure the IdP to send a group via memberOf.
7. Make sure the SAML assertion does NOT contain the Users group.
8. Log in with a completely new user.
9. Check the user's groups in Wiki.js.

Actual behavior

A newly created user receives:

Users
<SAML-mapped group>

The Users group is added by Wiki.js even though it is not present in the SAML assertion.

When the user logs in again, Users remains assigned even though "Unassign from groups no longer present in assertion" is enabled and Users is still not present in the assertion.

The same behavior occurs with existing users: the Users membership is not removed during SAML group synchronization.

Expected behavior

With:

• "Assign to groups" empty
• "Map Groups" enabled
• "Unassign from groups no longer present in assertion" enabled

the SAML IdP should be the authoritative source for group membership.

If the assertion contains only:

<SAML-mapped group>

the resulting Wiki.js membership should be:

<SAML-mapped group>

and NOT:

Users
<SAML-mapped group>

Additional information

I noticed there was previously a fix with the description:

d4eb8d8 - new users not put into Users group

However, I can still reproduce the behavior on Wiki.js 3.1.1 with a completely new user.

It therefore seems possible that this is a regression, or that the built-in Users group is handled separately from the SAML group synchronization / unassign logic.

The issue is reproducible with a newly created user as well as with an existing user.

Environment

• Wiki.js: 3.1.1
• Deployment: Docker
• Authentication: SAML 2.0
• Identity Provider: SAML Identity Provider (e.g. Microsoft Entra ID)
• SAML group attribute: memberOf

Thanks for taking a look at this. I'm not sure whether this is expected behavior or a regression, so I'd appreciate any clarification. If any additional information or testing is needed, I'll be happy to provide it.

[NGPixel]

This is as designed. The "Users" group includes all authenticated users and is always assigned. You don't have to give it any permission if it's not useful to you.