Double update of main attribute when SAML_USE_NAME_ID_AS_USERNAME is False

I noticed that when SAML_USE_NAME_ID_AS_USERNAME is False, whatever attribute is determined to be the main attribute here https://github.com/knaperek/djangosaml2/blob/fd6a8237ed7b2b2308de97b11773c1860139b048/djangosaml2/backends.py#L88-L90 gets applied to the user both on creation and on update of the attributes.

This double update does not seem necessary and can cause problems if a cleaning is defined on the main attribute that is separate from the cleaning of the attributes.

Example:

1. Configure an email attribute to be sent from the IdP and be used as the main attribute / set to be the username within Django

2. Define a cleaning on this main attribute that converts @ to _ (e.g., user@company within IdP —> user_company Django user)

3. When a user is created here, the username will be user_company as expected

4. Once the user is created, the attributes will be updated here and the username will change to the attribute value of user@company, which is not desired.

Any suggestions / feedback on the above? I may be missing a best practice configuration here. Thanks!

[peppelinux]

@jaap3 I think that you’re the man I’d Be Happy to read you PR related on that with some of your awesome tests

You’re in the flow, please don’t stop the 🧠

[jaap3]

Would adding if attr == self._user_lookup_attribute(): continue right before https://github.com/IdentityPython/djangosaml2/blob/fd6a8237ed7b2b2308de97b11773c1860139b048/djangosaml2/backends.py#L164 solve this issue?

That way _update_user would never update the field that was just used to create/find the user it’s updating right?