Best practices for troubleshooting SSO...?

🤝 Discussion
,
1

As we configure a new space (cloud, enterprise) for user-authentication, it often takes several iterations to get the SSO configuration right.

In our current instance, we have authentication working, but we don’t have firstName/lastName mapped properly, so user-names look like “Null, Null”.

The thing is, those names only “come in” to Retool on the first login attempt. If we do reconfigure the SSO settings and then finally “get it right” we can’t test the same username again; that user is already active and configured (incorrectly).

We tried the gmail approach of username+randomsuffix@domain.tld which works fine on the Google side, but Retool still sees it as username@domain.tld which is already set-in-stone, so to speak.

And we haven’t found any facility for “reset/delete/obliterate” an existing user to allow for iterative testing, without cluttering up the user-list. Do we need to make fake email address accounts for further testing?

I’m hoping there’s something we missed… :crossed_fingers:

3

Hi @trillich! Thanks for your patience and sorry to hear that the SSO config process hasn't been seamless for you.

Just checking in to see if you have found a solution yet? If not, then perhaps I can get more info from you to help you out:

  1. What SSO provider are you currently using?
  2. If you are using a custom SSO, you can test your connection with the Test Connection button on the Single Sign-On (SSO) > Custom SSO settings page. Doing this does not alter permission groups, nor will it lock your account if the SSO config is not set up properly.
  3. If you're using OIDC, could you use OpenID Connect Debugger or other 3rd party tools to understand the response you're receiving from SSO?
  4. Could your "Null, Null" users able to login and manually change their first and last name in Settings > My account?

Let me know if you need further assistance from here!

Thanks :slight_smile:
-Jen