SCIM unable to create users where username and email are not matching

Ask the Community Password Manager
1

Hi,

We are running SCIM in Azure and are unable to create users where the primary email and userPrincipalName are not the same. In the documentation it says emails or userName but for users were the primary email and userPrincipalName are the same we have no issues.

Is the SCIM setup to not allow username and email to be different?

2

Thanks for the information! Can you submit a ticket here: Get in Touch | Bitwarden

3

Thanks, I will.

On a side note. While troubleshooting this I tried to do a GET to the /Users endpoint but no data was returned even though the request was 200 OK. Is that intended?

4

Same issue with us. Bitwarden supports keeps saying that UPN and email should be the same.
4 users within our organisation with a different e-mail domain but same SSO company domain weā€™ve now manually added to the admin console; and linked the groups mannualy.
1 user got divorced, 1 user got married. UPN stayed the same, but primary e-mail adres was changed. same kind of issues.

We use SCIM provisioning from Azure where al fields are linked including Email linked to UPN field from Azure.
SSO from Azure all fields towards Bitwarden are linked to UPN.

But still Bitwarding onboarding retrieves the email address somehow from Azure during onboarding.

Bitwarden support keeps telling dat UPN and Email should be te same.
But this is not an option for my organization.

Iā€™m now working with this workarround manual creation of user accounts.;
I donā€™t see a solution yet.

5

In Azure, you can change the attribute mappings on SCIM and SAML. For the ā€œUsernameā€ SCIM attribute (and NameID SAML claim), you could send them the email instead of UPN.

That said, Bitwarden is wrong. There is no requirement that UPN and email match. Some companies intentionally make them different so that knowing someoneā€™s email does not aid in compromising a login. And, if somebody does not have a company mailbox, it is perfectly legal to put their gmail account in the email field so it shows up in corporate/school address book.

6

Thanks,

Weā€™ve intentionally mapped al e-mail related fields in SCIM and SAML to UPN field in Azure AD. But the behaviour of onboarding with SCIM provisioned accounts just got wearder and wearder.

In the onboarding proces Bitwarden managed still retrieves e-mail and UPN form what I think is the SAML / SSO application.

What weā€™ve done now is set e-mail[ā€œworkā€] to user.mail (this is the default). And externalId to the Azure Ad objectID (Guid code). This was default set to ā€˜mailnicknameā€™
With a powershell script provided by Bitwarden support weā€™ve set al external ID filed fo our other users to Azure Ad objectID.

The users with difference between UPN and E-Mail weā€™ve created manual in Bitwarden. On the onboarding proces we see that Bitwarden then creates a second account in Bitwarden with status invited. I think that Bitwarden calls this JIT provisioning. This second account with status invite is then deleted.

I think there are background processes setup which are not visual to customer, but Bitwarden doesnā€™t want to redesign so that a UPN and e-mail address may differ.

1 Like