Unable to login as admin with SAML auth module configured

Problem

JetBrains IDE Services instance could not be activated successfully because of insufficient user permissions.

Cause

1. Incorrect SAML configuration was detected.
2. Incorrect attribute mappings configured on IDE Services side.

Resolution

To resolve these issues:

Step 1: Adjust SAML Configuration

• Ensure the SAML configuration follows the JetBrains IDE Services SAML guidelines.

Step 2: Ensure Correct Administrator Mapping

1. Confirm that the tbe.auth.root-admin-emails section in the application.yaml includes all organization administrators' email addresses.

   root-admin-emails:
       - "admin@example.com"
       - "another_admin@example.com"
   

Step 3: Verify tbe.auth.saml.attribute-mappings values are correct.

1. Using SAML Tracer or browser Web Developer Tool record login attempt. Decode SAML Response (it is shown in Payload tab of authenticated network request) using SAML Decoder.

2. Define attributes from SAML Assertion and adjust tbe.auth.saml.attribute-mappings values with these attributes, e.g. for Entra ID SAML assertion:

   attribute-mapping:
     email: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
     firstName: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
     lastName: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
     fullName: http://schemas.microsoft.com/identity/claims/displayname
   

Step 4: Restart your IDE Services server with new settings applied.

Tips:

To define user attributes stored in IDE Services, you can execute in postgres instance connected to the IDE Services and verify TBE_USER table. Follow next steps to do it:

1. Execute in your database instance:

   psql -U <username> -d <db_name>
   

2. Verify user records in corresponding database table:

   SELECT * FROM "schema_name"."TBE_USER";
   

It will list all users currently presented in IDE Services with their permissions, e.g.:

postgresql=# SELECT * FROM "public"."TBE_USER";

                  ID                  | VERSION | CREATED_BY |         CREATED_DATE         | LAST_MODIFIED_BY | LAST_MODIFIED_DATE |        USERNAME        |       EMAIL           | IS_ACTIVE |        SUBJECT         |           PERMISSIONS            |  IDEP_STATUS   |   AI_STATUS    |   CWM_STATUS   | HUB_SUBJECT
--------------------------------------+---------+------------+------------------------------+------------------+--------------------+------------------------+-----------------------+-----------+------------------------+----------------------------------+----------------+----------------+----------------+-------------
 11111111-2222-3333-4444-555555555555 |       1 | system     | 2026-03-11 10:19:14.71649+01 |                  |                    |             user       |   user@example.com    |     t     |    user@example.com    | [{"id": "USER", "type": "ROLE"}] | NOT_CONFIGURED | NOT_CONFIGURED | NOT_CONFIGURED |
(1 row)