We recently enabled SCIM provisioning for our SonarQube Cloud Enterprise after having SAML SSO already configured and working. Our existing users were created through SAML and were already using SonarQube Cloud successfully. After enabling SCIM, we observed the following behavior:
SCIM does not match the existing SAML users. - Instead, it creates a second account for the same person.
We now have duplicate accounts for several users.
Some users lost access to projects and existing analysis tokens stopped working with: "Not authorized or project not found.
SonarQube Cloud identifies an SSO user by the value your IdP sends as the SAML login attribute (NameID). SCIM matches on userName. If those two aren’t the exact same attribute, in the same format and case, we see two different people and create a second account.
The rest follows from that. SSO users get their permissions purely from group membership, and only reach an organization if they’re in a group inside it, so the duplicate account starts with nothing. And a token belongs to one account: your users are now authenticating as the new duplicate while the token still sits on the old account.
Could you go to your enterprise’s Administration > Single Sign-On (SSO) page and check the attribute mapping there against what your IdP sends for SCIM userName? That’s where the mismatch will show up.
If the mapping already lines up and you still get duplicates, come back with the raw SAML assertion and SCIM payload for one affected user plus timestamps, and we’ll dig in.
Funnily, we have a similar but exactly opposite issue: SCIM does not create some users because they already exist. Same outcome, though: users lost access to projects. @Guillaume_Peoch could this be related? Or just a coincidence?