Tridion Access Management - ForwardClaims issue

Question

We have configured Access Management with SAML idp and configured manager mail and name attributes under forward claims. But for some of the users updated manager details not getting updated in our report. We checked the SAML response and userclaims table,there we can see the correct data but our custom code still logging old manager name and email. We are capturing the details using below code.

Var claims = ClaimsPrincipal.current.Identities.First().Claims.ToList()

Any idea about this issue?

Answer 1

There turns out to be a bug in Access Management that old user claims are not removed when the user claims are updated (i.e. when the user logs in). As a result, you will get lots of records in the UserClaims table and you will also observe that when a user claim value changes, both the old and the new value are provided by Access Management.

This issue is being hotfixed as we speak.