Userinformation like Display Name , firstname, last Name , profile Picture getting deleted/reset after logout.
Noticed this today after updating from 3.0.0 to 3.1.2.
All the users I were testing were logged in via “OIDC”.
Happend at automatic logouts as well as manual logouts.
Thanks for reporting @S_Wildenhain. We are checking this. In the meantime, could you check and let us know if Refresh user attributes from IdP during sign in is setting is enabled in your OIDC config?
It was indeed toggled on, is this a new toggle or did it somehow activate while I did the upgrades , never noticed that one before.
Thanks for confirming. This setting has existed in Plane well before v3.0.0, with a default of off. We checked and confirmed there’s no automatic behavior anywhere that can flip this setting on by itself. The only way it gets enabled is an admin explicitly toggling it in the OIDC authentication settings. So this was very likely toggled at some point previously and simply went unnoticed.
With this setting enabled, Plane re-syncs each user’s display name, first/last name, and avatar from your identity provider on every login, overwriting anything customized locally in Plane. The avatar is especially affected, since the existing one is removed before attempting to fetch a replacement, so if your IdP doesn’t provide a picture, the user ends up with none. Essentially, the IdP is treated as the source of truth and local customisations are reset to whatever the IdP provides, even if a particular field isn’t sent.