[question] SAML IdPs added via API get deactivated on UAA restart

Hi, not sure if this is the right place, but I have a general question regarding custom IdPs that I’m adding through UAA’s identity-provider API. Each created IdP represents an IdP configuration (e.g. Okta) for a given tenant within an external system. I store each IdP with the active flag set to true. However on UAA restart, it appears that any IdP’s active flag gets reverted back to false.

This is what an example IdP record looks like in UAA:

  {
    "type": "saml",
    "config": {
      "emailDomain": null,
      "additionalConfiguration": null,
      "providerDescription": null,
      "externalGroupsWhitelist": [],
      "attributeMappings": {},
      "addShadowUserOnLogin": true,
      "storeCustomAttributes": false,
      "metaDataLocation": "metadata here",
      "idpEntityAlias": "ORIGIN-17",
      "zoneId": "uaa",
      "nameID": null,
      "assertionConsumerIndex": 0,
      "metadataTrustCheck": false,
      "showSamlLink": false,
      "linkText": "ORIGIN-17",
      "iconUrl": null,
      "groupMappingMode": "EXPLICITLY_MAPPED",
      "skipSslValidation": false,
      "socketFactoryClassName": null
    },
    "id": "3378be77-1f75-4c96-93b8-2cba7d1768fa",
    "originKey": "ORIGIN-17",
    "name": "SAML-c4693123",
    "version": 55,
    "created": 1505362860495,
    "last_modified": 1508300404832,
    "active": false,
    "identityZoneId": "uaa"
  }

From looking at the source code the IdentityProviderBootstrap.deactivateUnusedProviders method sets active status to false for all IdP if their type is not uaa (in my case type is saml) and if they are not among current configured providers. “Configured providers” are loaded in via the BootstrapSamlIdentityProviderConfigurator, which looks into the login.yml. I have the entire provider section commented out in the login.yml, since I am adding IdPs via the API and don’t know which ones will exist in advance.

#BEGIN SAML PROVIDERS
#    providers:
#      okta-signed-or-encrypted:
#        idpMetadata: |
#          <?xml version="1.0" encoding="UTF-8"?><md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2
[...]

Is this the intended behavior? Do I need to change the “type” of my saml IdP record to “uaa” to avoid its active field to get set to false?

Cheers!

[fhanik]

@munic yes, there is cloudfoundry.slack.com, channel #uaa - you can request access here https://slack.cloudfoundry.org/

[sreetummidi]

being fixed in 4.9.0