SSO Setup Error: "The user has no groups assigned that are available in shelf" (Entra ID)

[AN0DA]

Hi everyone!
I'm trying to set up SSO on a self-hosted deployment of both Shelf (9a39ba0, v1.18.3) and Supabase. I followed essentially the same setup path as described in discussion #1665, with the main difference being that I'm using Entra ID instead of Google Workspace.

Current Status

The authentication flow is working (user can authenticate with Entra ID and gets redirected back), but I'm encountering a persistent error:

"Failed to update SSO user. The user has no groups assigned that are available in shelf."

This error occurs on both the initial login attempt and all subsequent login attempts.

What I've Verified

• User and resources are correctly created in the Shelf database
• User exists in Supabase Auth
• GET /auth/v1/user response from Supabase Auth contains the correct group ID under ["user_metadata"]["custom_claims"]["groups"]
• SSO configuration in database:
  • Created row in public."SsoDetails" with fresh CUID and configuration matching the documentation
  • Set enable_SSO = true in public."Organizations"
  • Linked SsoDetailsId to the SsoDetails entry

Potential Issue Identified

When inspecting the Supabase Auth response, I noticed that ["user_metadata"]["custom_claims"]["groups"] contains a string with the group UUID, not an array of strings.

Looking at the Shelf source code, it appears to process groups as an array.
Could this data type mismatch be causing the issue?

Example of what I'm seeing:

{
  "user_metadata": {
    "custom_claims": {
      "groups": "7d2c3756-9b5b-463a-89a0-4d5780daa9a6"  // String instead of ["7d2c3756-9b5b-463a-89a0-4d5780daa9a6"]
    }
  }
}

Question

Do you have any suggestions for what the issue could be or how to debug it?
Thanks and have a great day!

[DonKoko]

hey @AN0DA. This is due to how you made the connection to the IDP with the supabase cli. There are some example attributes files inside sso folder. You need to make sure to use ./sso/attributes.json for the connection. You can see how groups is set to array. I also remember i had some issues some time ago with this in supabase but I think they fixed it. You can always check the auth schema tables inside supabase and see if the entry is added correctly with groups being an array.

[AN0DA]

Thanks, @DonKoko! That was exactly the issue - I had missed the attributes file and didn’t include "array": true in the group mapping. After adding it, the SSO setup works perfectly. Really appreciate your help!