From 0f40c7e27e465e7c831b4bca9252fe4c11800f9c Mon Sep 17 00:00:00 2001
From: Bryan Frimin <bryan@getprobo.com>
Date: Sat, 14 Feb 2026 20:10:55 +0100
Subject: [PATCH] Fix saml subject not populated

Signed-off-by: Bryan Frimin <bryan@getprobo.com>
---
 pkg/iam/saml/service.go | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkg/iam/saml/service.go b/pkg/iam/saml/service.go
index b45500d25..d2601aaca 100644
--- a/pkg/iam/saml/service.go
+++ b/pkg/iam/saml/service.go
@@ -278,6 +278,12 @@ func (s *Service) HandleAssertion(
 			} else {
 				identity.EmailAddress = email
 				identity.FullName = fullname
+
+				// Identity can exist (e.g. provisioned via SCIM) but not have a SAML subject
+				if identity.SAMLSubject == nil {
+					identity.SAMLSubject = &assertion.Subject.NameID.Value
+				}
+
 				identity.EmailAddressVerified = true
 				identity.UpdatedAt = now