hi, following my adventure with user search by email in SSO tenant i found something a bit weird. in an SSO tenant i see 2 users with the same email, one entry for social authentication and one for SSO. how can this happen? shouldn't the users be consolidated once SSO in introduced?

Hey Eran, pls see my comment here https://authtown.slack.com/archives/C04490U8M7A/p1765520188595629?thread_ts=1765477144.268669&channel=C04490U8M7A&message_ts=1765520188.595629

hi @Reuven Zabirov, wen't over the thread and i don't think it's the same issue. configuration seems fine. in my case i see the login id generated for sso is

email-tenant_id

, and the social login is

email

,

google-#

(social identifier) from what i understand in the other thread this means the SAML returns the email as the name id which is the same as the existing login id and the users should be merged. saw there's an SSO troubleshooting link, anything specific i should look into?

1. you can search for the audit for his SSO login, there should be the SAML response / OIDC created user. 2. we strongly advise against merging of this kind (between SSO and social login) read here https://docs.descope.com/sso/merging-sso-identities-risk 3. if you still want this risk to be available, in that case you need to add the email as a login ID after successful SSO authentication (in the flow as a "Update User / Attributes" action with loginId = email). for SCIM it might be more complicated but achievable.

btw tried to export the entries for this user and i think there's a bug that SSO isn't exported correctly. one of these should have SSO configured

i'll have the team look into the export.

thanks for the clarifications so far! it seems i miss understood something in our implementation and the existing state is expected. 😅

great, let me know if you need anything else🙏