Hi all,
We’re enabling SSO and SCIM on SonarQube Cloud Enterprise. Our goal is for users to be able to sign in via either GitHub or Okta, with both methods working against the same account. We’ve hit a problem with identity matching and would like to confirm the right approach before rolling out to everyone.
Current state, all showing as configured and synchronised:
- Single sign-on via Okta (SAML), company domain verified
- Provisioning (SCIM) configured
- IdP group mapping synchronised
Until now everyone has signed in through GitHub, and those accounts hold the existing permissions, including organisation Admin.
The problem is, when a user whose email already exists on a GitHub account signs in via SAML for the first time, SonarQube treats it as a new identity rather than linking the two. The user is told their email is already linked to their GitHub account, and that continuing will move the email to a new account and stop notifications on the original.
The result is two separate accounts for the same person. The original GitHub one and a new SAML one with an auto generated login that looks like the email with a random suffix appended (something like user@company.com-XXXX@sso-...). That suffix looks like a collision rename, as though it couldn’t reconcile the two identities.
Appreciate any help or insight anyone might have.