As we configure a new space (cloud, enterprise) for user-authentication, it often takes several iterations to get the SSO configuration right.
In our current instance, we have authentication working, but we don’t have firstName/lastName mapped properly, so user-names look like “Null, Null”.
The thing is, those names only “come in” to Retool on the first login attempt. If we do reconfigure the SSO settings and then finally “get it right” we can’t test the same username again; that user is already active and configured (incorrectly).
We tried the gmail approach of username+randomsuffix@domain.tld which works fine on the Google side, but Retool still sees it as username@domain.tld which is already set-in-stone, so to speak.
And we haven’t found any facility for “reset/delete/obliterate” an existing user to allow for iterative testing, without cluttering up the user-list. Do we need to make fake email address accounts for further testing?
Hi @trillich! Thanks for your patience and sorry to hear that the SSO config process hasn't been seamless for you.
Just checking in to see if you have found a solution yet? If not, then perhaps I can get more info from you to help you out:
What SSO provider are you currently using?
If you are using a custom SSO, you can test your connection with the Test Connection button on the Single Sign-On (SSO) > Custom SSO settings page. Doing this does not alter permission groups, nor will it lock your account if the SSO config is not set up properly.
If you're using OIDC, could you use OpenID Connect Debugger or other 3rd party tools to understand the response you're receiving from SSO?
Could your "Null, Null" users able to login and manually change their first and last name in Settings > My account?
Let me know if you need further assistance from here!
The customer is using Google Auth, and after a few back-and-forth we did get things working. We wound up having to use identifiers such as urn:oid:2.5.4.42 to get GivenName. Once it works, we leave it alone!
And our end-users don’t get to see the Retool interface so they can’t change their bio. Instead, we drop them into a landing page… New users now have their full name showing properly; the only nameless one is their IT guy, but he knows he’s not the demographic, so we are good to go for now.
Great, glad to hear that things are working fine now! Appreciate you sharing these details with us
If you end up needing assistance in the future, don't hesitate to let us know! We are also available in our live Office Hours over Zoom if it is easier to show your SSO setup that way.
so they can’t change their bio. Instead, we drop them into a landing page… New users now have their full name showing properly; the only nameless one is their IT guy, but he knows he’s not the demographic, so we are good to go for now.