This message was deleted.

This occurs for the user that configured the SAML Rancher Auth Provider via the UI. Other users should be able to log in via SAML and have a distinct principle used for permissions which is used for Auth inside the download kubeconfig file. Can you confirm what version you're using and very explicit steps to reproduce?

So we finally got it working correctly, the issue was that the field set as

uid

was not present in the SAML payload. I would classify it as a bug as the default behavior if a required field is missing should be to fail or error vs providing admin rights.

Please can you confirm what version of rancher you're using?

Sorry, forgot that.. we are on 2.6.13

I've passed this on to an internal team who are currently investigating. I'll ask for an update

In our setup the parameter in Rancher set for userid was not in the SAML payload (.e.g. rancher told to look for

uid

and it was being passed as

username

in the SAML payload). When that happened a user was created in rancher for the inbound user but all of the information on the user matched that of the user used to create the saml connection - and the

adfs_user://

is blank e.g.

"principalIds": [
"<local://user-bwvxn>",
"adfs_user://"
],

the

user-*

name provided in the kubeconf would be that of the admin user too. We recreated and saw this on 2.6.11, 2.6.12, and 2.6.13 before we finally caught the payload token mismatch in name