Incorrect user permissions with SAML configured

Problem

User which was used to log in to IDE Services was a regular user instead the administrator.

Cause

The primary causes of the problem were:

• Incorrect SAML configuration and attribute mappings.
• Insufficient administrator privileges due to misconfigurations in the tbe.auth.root-admin-emails parameter in the application.yaml configuration file.

Resolution

1. Debugging Authentication and Authorization:

   • Captured SAML traces using SAML Tracer browser extension.
   • Decoded SAML responses to review and adjusted attribute mappings in the configuration file application.yaml, ensuring proper user permissions.
   • Verified and updated tbe.auth.root-admin-emails and tbe.auth.mapping.groups to include all necessary administrators and groups responsible for license and server management.

2. SAML and License Activation:

   • Adjusted saml.attribute-mapping entries to correctly map user attributes from the Identity Provider (IdP).
   • Verified that the admin group from the IdP configuration matched the groups in tbe.auth.mapping for proper synchronization (if user import is enabled).

Future issues can be addressed by referring to the documented resolution steps or contacting JetBrains Support.