Loggin in via existing Azure OIDC creates new user

[ericmoon]

Strange on here I'm trying to figure out.

At some point in the last week(s), seemingly coinciding with an upgrade from 1.53 to 1.55, my azure login created a duplicate entry. I can no longer access the 'old' azure id.

The only difference seems to be capitalization. eg. UID went from "user//~azure:FName-A@example.com" to user//~azure:fname-a@example.com"

Things I've tried:
Moving back to stable 1.44 - same
Moving back to stable 1.44 and restoring a backup from a working time - same
Changing the capitalization of the account in the DC -> azure (hybrid) - same

The main issue that I'm trying to get fixed is that the original account had 4 device groups. The new account obviously has none. I can't access those 4 device groups no matter what I do, since they were created with the 'old' account.

Any ideas what to try next?

[si458]

yes this is a side effect sadly of #7449 and happened in 1.1.55 release
the gent in that issue was having the issue where it kept creating uppercase or lowercase user accounts and he was losing his permissions
so we forced all user logins for azure to become lowercase now
in reality you SHOULDNT be using the azure for authStrategies as its old outdated and not really supported,
you should be using oidc instead as its more universal and secure!
the only fix at the moment is recreate all your permissions etc,
OR depending on the database,
down meshcentral for maintaince,
then edit the database directly so any reference to your old user identifier is changed with the new user identifier
DONT EDIT THE user//~azure: user record tho itself!

[si458]

you can also just add manageAllDeviceGroups: ['newuser//idgoeshere'] under settings in your config.json then restart meshcentral
this will let you user see/control all device groups in your domain from other users
this will regain you control of them at least too

[ericmoon]

That was the easiest way (managaAllDeviceGroups). just have to do that for the other admins and we'll be back to normal. Thanks again!

[si458]

@ericmoon glad its semi sorted for you, and we are so sorry again for this!
I tried to think of a way around it but without writing a migrate step to check ur whole db and migrate everything it was going to be a pain
And then what about people who use the api/websocket and look for Simon@ rather than simon@
I am so sorry again tho for this and just glad u at least have access to them again!

[ericmoon]

Thanks for the quick reply. I'll take a look later today and try your suggestions.

[si458]

sure no worries, always here to help!
any issues/problems you can always message on fleemail/disc/whats/tele/sig/tweet/etc 👍