SCIM: Update authinfoquery (#103123)

* Rewrite mismatched externalUID error message * Update AuhtInfo if user exists
2025-03-31 22:42:07 +02:00
parent 5ef9533751
commit d82d03a1d3
3 changed files with 16 additions and 9 deletions
@@ -48,7 +48,7 @@ var (
 	)
 	errMismatchedExternalUID = errutil.Unauthorized(
 		"user.sync.mismatched-externalUID",
-		errutil.WithPublicMessage("Mismatched externalUID"),
+		errutil.WithPublicMessage("Mismatched provisioned identity"),
 	)
 	errEmptyExternalUID = errutil.Unauthorized(
 		"user.sync.empty-externalUID",
@@ -134,6 +134,11 @@ func (s *UserSync) SyncUserHook(ctx context.Context, id *authn.Identity, _ *auth
 		}
 	}

+	if usr.IsProvisioned && id.ExternalUID != userAuth.ExternalUID {
+		s.log.Error("mismatched externalUID", "provisioned_externalUID", userAuth.ExternalUID, "identity_externalUID", id.ExternalUID)
+		return errMismatchedExternalUID.Errorf("externalUID mistmatch")
+	}
+
 	syncUserToIdentity(usr, id)
 	return nil
 }