SP side attribute mapping is highjacked by hidden mapping

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: Master
• Fix Version/s: Master
• Component/s: Application Security > SAML
• Labels:
  • 7.4-known-issues
  • QA-AUTOMATION
  • backend_test
  • liferay-ga10-ce-743
  • liferay-ga11-ce-743
  • liferay-ga12-ce-743
  • liferay-ga13-ce-743-known-issue
  • liferay-ga14-ce-743-known-issues
  • liferay-ga4-ce-743
  • liferay-ga5-ce-743
  • liferay-ga6-ce-743
  • liferay-ga7-ce-743
  • liferay-ga8-ce-743
  • liferay-ga9-ce-743
• Fix Priority: 4
• Sprint: AppSec Iteration 68, AppSec Iteration 69, AppSec Iteration 70, AppSec Iteration 71, AppSec Iteration 72, AppSec Iteration 73, AppSec Iteration 74, AppSec Iteration 75, AppSec Iteration 76, AppSec Iteration 77, AppSec Iteration 78, AppSec Iteration 79, AppSec Iteration 80, AppSec Iteration 81, AppSec Iteration 82, AppSec Iteration 83, AppSec Iteration 84, AppSec Iteration 85, AppSec Iteration 86
• Git Pull Request: https://github.com/liferay-appsec/liferay-portal/pull/636
• QA Test Name:
  • LocalFile.SAML#SPInitiatedSSODoesNotSyncAttributesIfNotMapped
  • LocalFile.SAML#SPInitiatedSSOSyncsUserAttributesFromMultipleIdPToSPCustomMapping
• QA Test Score: 8

Requirement:

• Have an already working SAML link between an IdP and an SP, with a user present in both!

Scenario 1:
Steps to reproduce:

1. On IdP side navigate to Service Provider Connections and in the existing SP link, enter firstName as an Attribute and click on Save
2. On SP side navigate to Identity Provider Connections and in the existing IdP link, delete any existing mapping, there should be 0.
3. On IdP side change the first name of the already registered user.
4. Log into SP using the credentials of said user.

Actual result:
First name of the user gets updated in SP
Expected result:
First name of the user should remain unchanged in SP
First name of the user gets updated in SP (new expected behavior after the changes)

Scenario 2:
Steps to reproduce:

1. On IdP side navigate to Service Provider Connections and in the existing SP link, enter firstName and jobTitle as an Attribute and click on Save
2. On SP side navigate to Identity Provider Connections and in the existing IdP link, create the following mapping: User Field Expression should be firstName and SAML Attribute should be jobTitle
3. On IdP side add job title for the user
4. Log into SP using the credentials of said user.

Actual result:
First name of the user remains unchanged in SP
Expected result:
In the SP the first name of the user should change to whatever was given as job title in IdP

Reproduced on:
Tomcat 9.0.43 + MySQL 8.0.25 | Portal master DXP GIT ID: fa392694486a70c3eb29f5e2d47ea7f1d01480f4

cc:Zsigmond Rab