Username updates for OIDC users are silently ignored

[lithomson]

Version

Waldur 8.0.9-rc.26

Deployment

Docker Compose under rootless Podman

Description

For users created via OIDC, editing the username through the UI appears to succeed, but the username is not updated.

Other editable fields (for example is_staff) are saved correctly.

Steps to reproduce

1. Log in as a staff user.
2. Navigate to Support → Users.
3. Edit an OIDC-created user.
4. Change the username to a valid lowercase value.
5. Save the user.

Expected behaviour

The username should be updated.

Actual behaviour

The request returns 200 OK, but the username remains unchanged.

The PATCH request payload contains the updated username, for example:

{
  "username": "lthomsonupdated",
  ...
}

However, the response immediately returns the original username:

{
  "username": "lthomson",
  ...
}

The username in the core_user table is also unchanged after the PATCH request.

As a diagnostic step, updating core_user.username directly in PostgreSQL succeeds immediately, and the updated username is reflected in the UI. This suggests the issue is not a database constraint, but occurs during the normal API save process.

Additional information

The affected users were created via OIDC (registration_method: "keycloak" in this deployment).

[lithomson]

Additional observation:

I have confirmed that this is not specific to OIDC-created users.

I created a new user directly in the Waldur UI and observed the same behaviour. The username can be edited in the form and is included in the PATCH request, but the username is not updated after saving, while other fields are updated successfully.

This appears to affect all user accounts rather than only users created via OIDC.

[livenson]

Hi,

so the bug is actually in UI - updating username via REST API is not really supported at the moment, as this introduces potentially multi-step attacks.

However, can you clarify your use case more?

[lithomson]

Thanks for the clarification.

My use case is an OIDC-authenticated deployment.

Users authenticate via Microsoft Entra ID, and Waldur creates the user account on first login. The generated usernames are long opaque identifiers, which are not particularly helpful for administrators when managing users through the Waldur UI.

While investigating whether those usernames could be updated to something more meaningful, I noticed that the UI allows the username field to be edited and sends the updated value in the PATCH request, but the value is ignored by the backend while other fields (such as is_staff) are updated successfully.

If updating usernames via the API is intentionally unsupported, perhaps the UI could make the username field read-only or omit it from the update request, as the current behaviour suggests that the change should be applied.

[livenson]

1. yes, UI will make it rdonly in the next RC.
2. if you want more human-friendly labels as username, you can either for waldur oidc client add a mapping of sub field to that human friendly label, or update OIDC configuration on waldur side and update "User claim" value from sub to something else.

[lithomson]

Thanks, that makes sense. I'll review the available claims when I configure the Entra OIDC integration.