We're testing out the new attribute mapping module with a simple "First Name" field mapped from "givenName" in our SAML response. But it fails with a "validation error"

The error is as follows:

Validation errors were encountered while synchronizing SAML attributes into the user account: givenName ('Brian') > field_first_name

I don't know what the validation error could be as everything is string/plain text.

Thoughts?

Comments

bricas created an issue. See original summary.

roderik’s picture

This is a self review of code I (re)wrote last december, which hasn't received much feedback yet.

The above message is logged if the following method returns FALSE:

https://git.drupalcode.org/project/samlauth/-/blob/8.x-3.x/modules/samla...

So my first guess / question is: does field_first_name actually exist as a field on the user? Was it maybe deleted after the mapping was set?

If so, I should add an error log message saying that. (And I think we should still fail - because this would be a "I don't know what is happening here but the site administrator can fix it, and therefore should fix it before we are willing to go on" kind of error.)

bricas’s picture

@roderik The field definitely exists, and definitely was not deleted at any point.

roderik’s picture

That will require some debugging then. Because the inside of

$field_definition = $account->getFieldDefinition($account_field_name);

are unknown territory to me, and I don't know when/why they would return an empty value

That... or overriding the samlauth_user_fields.event_subscriber.user_sync service with a custom child class

class MySubscriber extends UserFieldsEventSubscriber {
  
  protected function validateAccountFieldValue($input_value, UserInterface $account, $account_field_name) {
    // User field validation fails for some reason and we don't want to find
    // out why, right now. We'll trust our setup / attribute values implicitly.
    return TRUE;
  }
}

...and leaving this issue open until that time when you want to debug and/or someone else comes along.

bricas’s picture

I've done some digging, and with the following:

$violations = $data->validate();

When it's valid, you still get a violation list object, it just happens to be empty. So the line

$valid = !(bool) $violations;

Will return false instead of true. I think you can do

$valid = !$violations->count()

instead to get a proper result.

roderik’s picture

Status: Active » Needs work

Argh - thank you!

Strange I didn't spot this myself while testing.
Edit: I figured you could just cast a Countable to a boolean, and that would always evaluate to FALSE if its count value is 0. Hence the!(bool) $violations; rather than just !$violations;. So I don't get that part... yet.

I'll kick it around some more.

This will go in before the 3.0 release.

  • roderik committed 53cbc40 on 8.x-3.x authored by bricas
    Issue #3202505 by bricas: Fix validation error when trying to map...
roderik’s picture

Status: Needs work » Fixed

Actually you're right, and there's no need for me to 'act smart'.

$data->validate() returns a ConstraintViolationListInterface. There's no need for me to second guess the interface specs and assume it might e.g. return NULL. So I can just call count().

Thanks again.

bricas’s picture

Correct me if I'm wrong, but won't

if ($violations) { ... }

always be true?

  • roderik committed 391f721 on 8.x-3.x
    Issue #3202505 by bricas: Fix validation error when trying to map...
  • roderik committed e329e83 on 8.x-3.x
    Issue #3202505 by bricas: Fix validation error when trying to map...
roderik’s picture

LOL. I should never quickly commit a fix in between other things, that always goes wrong.

Which I'm now, of course, saying while quickly committing a fix in between other fixes, because stubborn :p

(So now that we always have a countable, let's do a little more reorganisation.)

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.