Remove default role configuration

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

apps/console/src/hooks/graph/SAMLConfigurationGraph.ts

@@ -30,7 +30,6 @@ const createSAMLConfigurationMutation = graphql`
         attributeFirstname
         attributeLastname
         attributeRole
-        defaultRole
         autoSignupEnabled
         createdAt
         updatedAt
@@ -61,7 +60,6 @@ const updateSAMLConfigurationMutation = graphql`
         attributeFirstname
         attributeLastname
         attributeRole
-        defaultRole
         autoSignupEnabled
         createdAt
         updatedAt

apps/console/src/hooks/graph/__generated__/OrganizationGraph_ViewQuery.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<220f85396d6d4c5c04f730d07aaa42e1>>
+ * @generated SignedSource<<11a62d34dafa502e3a464b91e12728ea>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -621,13 +621,6 @@ return {
                     "name": "attributeRole",
                     "storageKey": null
                   },
-                  {
-                    "alias": null,
-                    "args": null,
-                    "kind": "ScalarField",
-                    "name": "defaultRole",
-                    "storageKey": null
-                  },
                   {
                     "alias": null,
                     "args": null,
@@ -648,12 +641,12 @@ return {
     ]
   },
   "params": {
-    "cacheID": "782dc2328cea4f0c350427bda92a5615",
+    "cacheID": "a44a7b84f5f4c569d028f1d88deadb99",
     "id": null,
     "metadata": {},
     "name": "OrganizationGraph_ViewQuery",
     "operationKind": "query",
-    "text": "query OrganizationGraph_ViewQuery(\n  $organizationId: ID!\n) {\n  node(id: $organizationId) {\n    __typename\n    ... on Organization {\n      id\n      name\n      ...SettingsPageFragment\n    }\n    id\n  }\n}\n\nfragment DomainSettingsTabFragment on Organization {\n  id\n  customDomain {\n    id\n    domain\n    sslStatus\n    dnsRecords {\n      type\n      name\n      value\n      ttl\n      purpose\n    }\n    createdAt\n    updatedAt\n    sslExpiresAt\n  }\n}\n\nfragment GeneralSettingsTabFragment on Organization {\n  id\n  name\n  logoUrl\n  horizontalLogoUrl\n  description\n  websiteUrl\n  email\n  headquarterAddress\n  createdAt\n  updatedAt\n}\n\nfragment MembersSettingsTabInvitationsFragment on Organization {\n  invitations(first: 20, orderBy: {direction: ASC, field: CREATED_AT}) {\n    totalCount\n    edges {\n      node {\n        id\n        fullName\n        email\n        role\n        status\n        createdAt\n        expiresAt\n        acceptedAt\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n  id\n}\n\nfragment MembersSettingsTabMembershipsFragment on Organization {\n  memberships(first: 20, orderBy: {direction: ASC, field: CREATED_AT}) {\n    totalCount\n    edges {\n      node {\n        id\n        fullName\n        emailAddress\n        role\n        authMethod\n        createdAt\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n  id\n}\n\nfragment SAMLSettingsTabFragment on Organization {\n  id\n  name\n  samlConfigurations {\n    id\n    enabled\n    emailDomain\n    enforcementPolicy\n    domainVerified\n    domainVerificationToken\n    domainVerifiedAt\n    spEntityId\n    spAcsUrl\n    spMetadataUrl\n    testLoginUrl\n    idpEntityId\n    idpSsoUrl\n    idpCertificate\n    idpMetadataUrl\n    attributeEmail\n    attributeFirstname\n    attributeLastname\n    attributeRole\n    defaultRole\n    autoSignupEnabled\n  }\n}\n\nfragment SettingsPageFragment on Organization {\n  id\n  name\n  ...GeneralSettingsTabFragment\n  ...MembersSettingsTabMembershipsFragment\n  ...MembersSettingsTabInvitationsFragment\n  ...DomainSettingsTabFragment\n  ...SAMLSettingsTabFragment\n}\n"
+    "text": "query OrganizationGraph_ViewQuery(\n  $organizationId: ID!\n) {\n  node(id: $organizationId) {\n    __typename\n    ... on Organization {\n      id\n      name\n      ...SettingsPageFragment\n    }\n    id\n  }\n}\n\nfragment DomainSettingsTabFragment on Organization {\n  id\n  customDomain {\n    id\n    domain\n    sslStatus\n    dnsRecords {\n      type\n      name\n      value\n      ttl\n      purpose\n    }\n    createdAt\n    updatedAt\n    sslExpiresAt\n  }\n}\n\nfragment GeneralSettingsTabFragment on Organization {\n  id\n  name\n  logoUrl\n  horizontalLogoUrl\n  description\n  websiteUrl\n  email\n  headquarterAddress\n  createdAt\n  updatedAt\n}\n\nfragment MembersSettingsTabInvitationsFragment on Organization {\n  invitations(first: 20, orderBy: {direction: ASC, field: CREATED_AT}) {\n    totalCount\n    edges {\n      node {\n        id\n        fullName\n        email\n        role\n        status\n        createdAt\n        expiresAt\n        acceptedAt\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n  id\n}\n\nfragment MembersSettingsTabMembershipsFragment on Organization {\n  memberships(first: 20, orderBy: {direction: ASC, field: CREATED_AT}) {\n    totalCount\n    edges {\n      node {\n        id\n        fullName\n        emailAddress\n        role\n        authMethod\n        createdAt\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n  id\n}\n\nfragment SAMLSettingsTabFragment on Organization {\n  id\n  name\n  samlConfigurations {\n    id\n    enabled\n    emailDomain\n    enforcementPolicy\n    domainVerified\n    domainVerificationToken\n    domainVerifiedAt\n    spEntityId\n    spAcsUrl\n    spMetadataUrl\n    testLoginUrl\n    idpEntityId\n    idpSsoUrl\n    idpCertificate\n    idpMetadataUrl\n    attributeEmail\n    attributeFirstname\n    attributeLastname\n    attributeRole\n    autoSignupEnabled\n  }\n}\n\nfragment SettingsPageFragment on Organization {\n  id\n  name\n  ...GeneralSettingsTabFragment\n  ...MembersSettingsTabMembershipsFragment\n  ...MembersSettingsTabInvitationsFragment\n  ...DomainSettingsTabFragment\n  ...SAMLSettingsTabFragment\n}\n"
   }
 };
 })();

apps/console/src/hooks/graph/__generated__/SAMLConfigurationGraphCreateMutation.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<9232c5fa755e56b6a1ecdcdd51ad83db>>
+ * @generated SignedSource<<96f7708613cbb65e52114d120499ed46>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -16,7 +16,6 @@ export type CreateSAMLConfigurationInput = {
   attributeLastname?: string | null | undefined;
   attributeRole?: string | null | undefined;
   autoSignupEnabled?: boolean | null | undefined;
-  defaultRole?: string | null | undefined;
   emailDomain: string;
   enforcementPolicy: SAMLEnforcementPolicy;
   idpCertificate?: string | null | undefined;
@@ -40,7 +39,6 @@ export type SAMLConfigurationGraphCreateMutation$data = {
       readonly attributeRole: string;
       readonly autoSignupEnabled: boolean;
       readonly createdAt: any;
-      readonly defaultRole: string;
       readonly emailDomain: string;
       readonly enabled: boolean;
       readonly enforcementPolicy: SAMLEnforcementPolicy;
@@ -205,13 +203,6 @@ v1 = [
             "name": "attributeRole",
             "storageKey": null
           },
-          {
-            "alias": null,
-            "args": null,
-            "kind": "ScalarField",
-            "name": "defaultRole",
-            "storageKey": null
-          },
           {
             "alias": null,
             "args": null,
@@ -258,16 +249,16 @@ return {
     "selections": (v1/*: any*/)
   },
   "params": {
-    "cacheID": "71d5f80565cc8bc4cef0382c315b8cb1",
+    "cacheID": "1ee756f7dd01d0faf7f23b8291f70c20",
     "id": null,
     "metadata": {},
     "name": "SAMLConfigurationGraphCreateMutation",
     "operationKind": "mutation",
-    "text": "mutation SAMLConfigurationGraphCreateMutation(\n  $input: CreateSAMLConfigurationInput!\n) {\n  createSAMLConfiguration(input: $input) {\n    samlConfiguration {\n      id\n      enabled\n      emailDomain\n      enforcementPolicy\n      spEntityId\n      spAcsUrl\n      spMetadataUrl\n      testLoginUrl\n      idpEntityId\n      idpSsoUrl\n      idpCertificate\n      idpMetadataUrl\n      attributeEmail\n      attributeFirstname\n      attributeLastname\n      attributeRole\n      defaultRole\n      autoSignupEnabled\n      createdAt\n      updatedAt\n    }\n  }\n}\n"
+    "text": "mutation SAMLConfigurationGraphCreateMutation(\n  $input: CreateSAMLConfigurationInput!\n) {\n  createSAMLConfiguration(input: $input) {\n    samlConfiguration {\n      id\n      enabled\n      emailDomain\n      enforcementPolicy\n      spEntityId\n      spAcsUrl\n      spMetadataUrl\n      testLoginUrl\n      idpEntityId\n      idpSsoUrl\n      idpCertificate\n      idpMetadataUrl\n      attributeEmail\n      attributeFirstname\n      attributeLastname\n      attributeRole\n      autoSignupEnabled\n      createdAt\n      updatedAt\n    }\n  }\n}\n"
   }
 };
 })();
 
-(node as any).hash = "04237f5ad3588264149310798d6137f2";
+(node as any).hash = "43058268e0b04e8b8a83ce91b8908bf7";
 
 export default node;

apps/console/src/hooks/graph/__generated__/SAMLConfigurationGraphUpdateMutation.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<694befcb248cbb23e66b9555626f223b>>
+ * @generated SignedSource<<700f12180d1cfa94050704af029b84d7>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -16,7 +16,6 @@ export type UpdateSAMLConfigurationInput = {
   attributeLastname?: string | null | undefined;
   attributeRole?: string | null | undefined;
   autoSignupEnabled?: boolean | null | undefined;
-  defaultRole?: string | null | undefined;
   enabled?: boolean | null | undefined;
   enforcementPolicy?: SAMLEnforcementPolicy | null | undefined;
   id: string;
@@ -39,7 +38,6 @@ export type SAMLConfigurationGraphUpdateMutation$data = {
       readonly attributeRole: string;
       readonly autoSignupEnabled: boolean;
       readonly createdAt: any;
-      readonly defaultRole: string;
       readonly emailDomain: string;
       readonly enabled: boolean;
       readonly enforcementPolicy: SAMLEnforcementPolicy;
@@ -204,13 +202,6 @@ v1 = [
             "name": "attributeRole",
             "storageKey": null
           },
-          {
-            "alias": null,
-            "args": null,
-            "kind": "ScalarField",
-            "name": "defaultRole",
-            "storageKey": null
-          },
           {
             "alias": null,
             "args": null,
@@ -257,16 +248,16 @@ return {
     "selections": (v1/*: any*/)
   },
   "params": {
-    "cacheID": "c9e4055888055b109aa71b665c9544ca",
+    "cacheID": "f8407666643c559232d42e8302c1e917",
     "id": null,
     "metadata": {},
     "name": "SAMLConfigurationGraphUpdateMutation",
     "operationKind": "mutation",
-    "text": "mutation SAMLConfigurationGraphUpdateMutation(\n  $input: UpdateSAMLConfigurationInput!\n) {\n  updateSAMLConfiguration(input: $input) {\n    samlConfiguration {\n      id\n      enabled\n      emailDomain\n      enforcementPolicy\n      spEntityId\n      spAcsUrl\n      spMetadataUrl\n      testLoginUrl\n      idpEntityId\n      idpSsoUrl\n      idpCertificate\n      idpMetadataUrl\n      attributeEmail\n      attributeFirstname\n      attributeLastname\n      attributeRole\n      defaultRole\n      autoSignupEnabled\n      createdAt\n      updatedAt\n    }\n  }\n}\n"
+    "text": "mutation SAMLConfigurationGraphUpdateMutation(\n  $input: UpdateSAMLConfigurationInput!\n) {\n  updateSAMLConfiguration(input: $input) {\n    samlConfiguration {\n      id\n      enabled\n      emailDomain\n      enforcementPolicy\n      spEntityId\n      spAcsUrl\n      spMetadataUrl\n      testLoginUrl\n      idpEntityId\n      idpSsoUrl\n      idpCertificate\n      idpMetadataUrl\n      attributeEmail\n      attributeFirstname\n      attributeLastname\n      attributeRole\n      autoSignupEnabled\n      createdAt\n      updatedAt\n    }\n  }\n}\n"
   }
 };
 })();
 
-(node as any).hash = "d572af05811d6a05cdd4446fe175894d";
+(node as any).hash = "c246d5e0bbebabf2bfbba5465e937f44";
 
 export default node;

apps/console/src/pages/organizations/settings/SAMLSettingsTab.tsx

@@ -62,7 +62,6 @@ const samlSettingsTabFragment = graphql`
       attributeFirstname
       attributeLastname
       attributeRole
-      defaultRole
       autoSignupEnabled
     }
   }
@@ -85,7 +84,6 @@ const samlConfigSchema = z.object({
   attributeFirstname: z.string().optional(),
   attributeLastname: z.string().optional(),
   attributeRole: z.string().optional(),
-  defaultRole: z.string().optional(),
   autoSignupEnabled: z.boolean().default(false),
 });
 
@@ -157,7 +155,6 @@ export default function SAMLSettingsTab() {
           attributeFirstname: editingConfig.attributeFirstname || "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname",
           attributeLastname: editingConfig.attributeLastname || "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname",
           attributeRole: editingConfig.attributeRole || "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role",
-          defaultRole: editingConfig.defaultRole || "MEMBER",
           autoSignupEnabled: editingConfig.autoSignupEnabled || false,
         }
       : {
@@ -171,7 +168,6 @@ export default function SAMLSettingsTab() {
           attributeFirstname: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname",
           attributeLastname: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname",
           attributeRole: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role",
-          defaultRole: "MEMBER",
           autoSignupEnabled: false,
         },
   });
@@ -189,7 +185,6 @@ export default function SAMLSettingsTab() {
         attributeFirstname: editingConfig.attributeFirstname || "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname",
         attributeLastname: editingConfig.attributeLastname || "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname",
         attributeRole: editingConfig.attributeRole || "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role",
-        defaultRole: editingConfig.defaultRole || "MEMBER",
         autoSignupEnabled: editingConfig.autoSignupEnabled || false,
       });
       initiateForm.reset({
@@ -207,7 +202,6 @@ export default function SAMLSettingsTab() {
         attributeFirstname: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname",
         attributeLastname: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname",
         attributeRole: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role",
-        defaultRole: "MEMBER",
         autoSignupEnabled: false,
       });
       initiateForm.reset({
@@ -263,7 +257,6 @@ export default function SAMLSettingsTab() {
             attributeFirstname: data.attributeFirstname || "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname",
             attributeLastname: data.attributeLastname || "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname",
             attributeRole: data.attributeRole || "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role",
-            defaultRole: data.defaultRole || "MEMBER",
             autoSignupEnabled: data.autoSignupEnabled || false,
           },
         },
@@ -286,7 +279,6 @@ export default function SAMLSettingsTab() {
             attributeFirstname: data.attributeFirstname || "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname",
             attributeLastname: data.attributeLastname || "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname",
             attributeRole: data.attributeRole || "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role",
-            defaultRole: data.defaultRole || "MEMBER",
             autoSignupEnabled: data.autoSignupEnabled || false,
           },
         },
@@ -701,23 +693,6 @@ export default function SAMLSettingsTab() {
               </div>
             </div>
 
-            <div>
-              <h3 className="text-base font-medium mb-4">
-                {__("Default Role")}
-              </h3>
-              <div className="space-y-4">
-                <Field
-                  {...form.register("defaultRole")}
-                  label={__("Default Role")}
-                  placeholder="MEMBER"
-                  error={form.formState.errors.defaultRole?.message}
-                />
-                <p className="text-xs text-gray-500">
-                  {__("The IdP must provide roles directly (OWNER, ADMIN, MEMBER, VIEWER). This default role will be used when the role attribute is missing or invalid.")}
-                </p>
-              </div>
-            </div>
-
             <div>
               <Controller
                 control={form.control}

apps/console/src/pages/organizations/settings/__generated__/SAMLSettingsTabFragment.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<0b3ea1127a3a6388e6d0802abea0307c>>
+ * @generated SignedSource<<ad8f1e5fd866cefc124b7b7c78bce367>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -20,7 +20,6 @@ export type SAMLSettingsTabFragment$data = {
     readonly attributeLastname: string;
     readonly attributeRole: string;
     readonly autoSignupEnabled: boolean;
-    readonly defaultRole: string;
     readonly domainVerificationToken: string | null | undefined;
     readonly domainVerified: boolean;
     readonly domainVerifiedAt: any | null | undefined;
@@ -201,13 +200,6 @@ return {
           "name": "attributeRole",
           "storageKey": null
         },
-        {
-          "alias": null,
-          "args": null,
-          "kind": "ScalarField",
-          "name": "defaultRole",
-          "storageKey": null
-        },
         {
           "alias": null,
           "args": null,
@@ -224,6 +216,6 @@ return {
 };
 })();
 
-(node as any).hash = "691298e053f77bcb6ef13a5869a86579";
+(node as any).hash = "eec380838cfd22d70a504028bb5046b4";
 
 export default node;

pkg/auth/saml_configuration_service.go

@@ -38,7 +38,6 @@ type (
 		AttributeFirstname string
 		AttributeLastname  string
 		AttributeRole      string
-		DefaultRole        string
 		AutoSignupEnabled  bool
 	}
 
@@ -54,7 +53,6 @@ type (
 		AttributeFirstname *string
 		AttributeLastname  *string
 		AttributeRole      *string
-		DefaultRole        *string
 		AutoSignupEnabled  *bool
 	}
 )
@@ -64,18 +62,8 @@ func (s TenantAuthService) CreateSAMLConfiguration(
 	req CreateSAMLConfigurationRequest,
 ) (*coredata.SAMLConfiguration, error) {
 	// Validate only the IdP configuration (user-provided data)
-	validationErrors := ValidateIdPConfiguration(
+	if err := ValidateIdPConfiguration(req.IdPEntityID, req.IdPSsoURL, req.IdPCertificate); err != nil {
-		req.IdPEntityID,
+		return nil, fmt.Errorf("SAML configuration validation failed: %w", err)
-		req.IdPSsoURL,
-		req.IdPCertificate,
-	)
-
-	if len(validationErrors) > 0 {
-		var errMsgs []string
-		for _, err := range validationErrors {
-			errMsgs = append(errMsgs, err.Error())
-		}
-		return nil, fmt.Errorf("SAML configuration validation failed: %s", strings.Join(errMsgs, "; "))
 	}
 
 	var config *coredata.SAMLConfiguration
@@ -105,7 +93,6 @@ func (s TenantAuthService) CreateSAMLConfiguration(
 				AttributeFirstname: req.AttributeFirstname,
 				AttributeLastname:  req.AttributeLastname,
 				AttributeRole:      req.AttributeRole,
-				DefaultRole:        req.DefaultRole,
 				AutoSignupEnabled:  req.AutoSignupEnabled,
 				CreatedAt:          now,
 				UpdatedAt:          now,
@@ -169,9 +156,6 @@ func (s TenantAuthService) UpdateSAMLConfiguration(
 			if req.AttributeRole != nil {
 				cfg.AttributeRole = *req.AttributeRole
 			}
-			if req.DefaultRole != nil {
-				cfg.DefaultRole = *req.DefaultRole
-			}
 			if req.AutoSignupEnabled != nil {
 				cfg.AutoSignupEnabled = *req.AutoSignupEnabled
 			}

pkg/auth/saml_mapper.go

@@ -74,16 +74,13 @@ func ExtractEmailDomain(email string) (string, error) {
 	return domain, nil
 }
 
-func MapSAMLRoleToSystemRole(samlRole string, defaultRole string) (string, error) {
+func MapSAMLRoleToSystemRole(samlRole string) string {
 	if samlRole != "" && isValidRole(samlRole) {
-		return samlRole, nil
+		return samlRole
 	}
 
-	if !isValidRole(defaultRole) {
+	// Default to MEMBER role if SAML role is missing or invalid
-		return "", fmt.Errorf("invalid default role %q", defaultRole)
+	return "MEMBER"
-	}
-
-	return defaultRole, nil
 }
 
 func isValidRole(role string) bool {

pkg/auth/saml_service.go

@@ -547,10 +547,7 @@ func (s *SAMLService) HandleSAMLAssertion(
 		return nil, fmt.Errorf("email domain mismatch: assertion contains email with domain %s but SAML config is for domain %s", actualEmailDomain, config.EmailDomain)
 	}
 
-	systemRole, err := MapSAMLRoleToSystemRole(samlRole, config.DefaultRole)
+	systemRole := MapSAMLRoleToSystemRole(samlRole)
-	if err != nil {
-		return nil, ErrCannotMapRole{Err: err}
-	}
 
 	samlSubject := ""
 	if assertion.Subject != nil && assertion.Subject.NameID != nil {

pkg/auth/service.go

@@ -1155,7 +1155,6 @@ func (s Service) InitiateDomainVerification(
 			AttributeFirstname: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname",
 			AttributeLastname:  "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname",
 			AttributeRole:      "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role",
-			DefaultRole:        "MEMBER",
 			AutoSignupEnabled:  false,
 			CreatedAt:          now,
 			UpdatedAt:          now,

pkg/coredata/migrations/20251029T185308Z.sql

@@ -0,0 +1,5 @@
+-- Remove default_role column from auth_saml_configurations
+-- The default role is now hardcoded to 'MEMBER' in the application code
+-- when the SAML role attribute is missing or invalid
+
+ALTER TABLE auth_saml_configurations DROP COLUMN default_role;

pkg/coredata/saml_configuration.go

@@ -39,7 +39,6 @@ type SAMLConfiguration struct {
 	AttributeFirstname      string                `db:"attribute_firstname"`
 	AttributeLastname       string                `db:"attribute_lastname"`
 	AttributeRole           string                `db:"attribute_role"`
-	DefaultRole             string                `db:"default_role"`
 	AutoSignupEnabled       bool                  `db:"auto_signup_enabled"`
 	DomainVerified          bool                  `db:"domain_verified"`
 	DomainVerificationToken *string               `db:"domain_verification_token"`
@@ -70,7 +69,6 @@ SELECT
     attribute_firstname,
     attribute_lastname,
     attribute_role,
-    default_role,
     auto_signup_enabled,
     domain_verified,
     domain_verification_token,
@@ -130,7 +128,6 @@ SELECT
     attribute_firstname,
     attribute_lastname,
     attribute_role,
-    default_role,
     auto_signup_enabled,
     domain_verified,
     domain_verification_token,
@@ -186,7 +183,6 @@ INSERT INTO auth_saml_configurations (
     attribute_firstname,
     attribute_lastname,
     attribute_role,
-    default_role,
     auto_signup_enabled,
     domain_verified,
     domain_verification_token,
@@ -208,7 +204,6 @@ INSERT INTO auth_saml_configurations (
     @attribute_firstname,
     @attribute_lastname,
     @attribute_role,
-    @default_role,
     @auto_signup_enabled,
     @domain_verified,
     @domain_verification_token,
@@ -233,7 +228,6 @@ INSERT INTO auth_saml_configurations (
 		"attribute_firstname":       s.AttributeFirstname,
 		"attribute_lastname":        s.AttributeLastname,
 		"attribute_role":            s.AttributeRole,
-		"default_role":              s.DefaultRole,
 		"auto_signup_enabled":       s.AutoSignupEnabled,
 		"domain_verified":           s.DomainVerified,
 		"domain_verification_token": s.DomainVerificationToken,
@@ -268,7 +262,6 @@ SET
     attribute_firstname = @attribute_firstname,
     attribute_lastname = @attribute_lastname,
     attribute_role = @attribute_role,
-    default_role = @default_role,
     auto_signup_enabled = @auto_signup_enabled,
     domain_verified = @domain_verified,
     domain_verification_token = @domain_verification_token,
@@ -293,7 +286,6 @@ WHERE
 		"attribute_firstname":       s.AttributeFirstname,
 		"attribute_lastname":        s.AttributeLastname,
 		"attribute_role":            s.AttributeRole,
-		"default_role":              s.DefaultRole,
 		"auto_signup_enabled":       s.AutoSignupEnabled,
 		"domain_verified":           s.DomainVerified,
 		"domain_verification_token": s.DomainVerificationToken,
@@ -357,7 +349,6 @@ SELECT
     attribute_firstname,
     attribute_lastname,
     attribute_role,
-    default_role,
     auto_signup_enabled,
     domain_verified,
     domain_verification_token,
@@ -417,7 +408,6 @@ SELECT
     attribute_firstname,
     attribute_lastname,
     attribute_role,
-    default_role,
     auto_signup_enabled,
     domain_verified,
     domain_verification_token,

pkg/server/api/console/v1/schema.graphql

@@ -4880,9 +4880,6 @@ type SAMLConfiguration implements Node {
   attributeLastname: String!
   attributeRole: String!
 
-  # Default role for users when role attribute is missing or invalid
-  defaultRole: String!
-
   # Auto-signup
   autoSignupEnabled: Boolean!
 
@@ -4927,7 +4924,6 @@ input CreateSAMLConfigurationInput {
   attributeLastname: String
   attributeRole: String
 
-  defaultRole: String
   autoSignupEnabled: Boolean
 }
 
@@ -4946,7 +4942,6 @@ input UpdateSAMLConfigurationInput {
   attributeFirstname: String
   attributeLastname: String
   attributeRole: String
-  defaultRole: String
   autoSignupEnabled: Boolean
 }
 

pkg/server/api/console/v1/schema/schema.go

@@ -1238,7 +1238,6 @@ type ComplexityRoot struct {
 		AttributeRole           func(childComplexity int) int
 		AutoSignupEnabled       func(childComplexity int) int
 		CreatedAt               func(childComplexity int) int
-		DefaultRole             func(childComplexity int) int
 		DomainVerificationToken func(childComplexity int) int
 		DomainVerified          func(childComplexity int) int
 		DomainVerifiedAt        func(childComplexity int) int
@@ -7502,13 +7501,6 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
 
 		return e.complexity.SAMLConfiguration.CreatedAt(childComplexity), true
 
-	case "SAMLConfiguration.defaultRole":
-		if e.complexity.SAMLConfiguration.DefaultRole == nil {
-			break
-		}
-
-		return e.complexity.SAMLConfiguration.DefaultRole(childComplexity), true
-
 	case "SAMLConfiguration.domainVerificationToken":
 		if e.complexity.SAMLConfiguration.DomainVerificationToken == nil {
 			break
@@ -14628,9 +14620,6 @@ type SAMLConfiguration implements Node {
   attributeLastname: String!
   attributeRole: String!
 
-  # Default role for users when role attribute is missing or invalid
-  defaultRole: String!
-
   # Auto-signup
   autoSignupEnabled: Boolean!
 
@@ -14675,7 +14664,6 @@ input CreateSAMLConfigurationInput {
   attributeLastname: String
   attributeRole: String
 
-  defaultRole: String
   autoSignupEnabled: Boolean
 }
 
@@ -14694,7 +14682,6 @@ input UpdateSAMLConfigurationInput {
   attributeFirstname: String
   attributeLastname: String
   attributeRole: String
-  defaultRole: String
   autoSignupEnabled: Boolean
 }
 
@@ -29048,8 +29035,6 @@ func (ec *executionContext) fieldContext_CreateSAMLConfigurationPayload_samlConf
 				return ec.fieldContext_SAMLConfiguration_attributeLastname(ctx, field)
 			case "attributeRole":
 				return ec.fieldContext_SAMLConfiguration_attributeRole(ctx, field)
-			case "defaultRole":
-				return ec.fieldContext_SAMLConfiguration_defaultRole(ctx, field)
 			case "autoSignupEnabled":
 				return ec.fieldContext_SAMLConfiguration_autoSignupEnabled(ctx, field)
 			case "testLoginUrl":
@@ -33183,8 +33168,6 @@ func (ec *executionContext) fieldContext_DisableSAMLPayload_samlConfiguration(_
 				return ec.fieldContext_SAMLConfiguration_attributeLastname(ctx, field)
 			case "attributeRole":
 				return ec.fieldContext_SAMLConfiguration_attributeRole(ctx, field)
-			case "defaultRole":
-				return ec.fieldContext_SAMLConfiguration_defaultRole(ctx, field)
 			case "autoSignupEnabled":
 				return ec.fieldContext_SAMLConfiguration_autoSignupEnabled(ctx, field)
 			case "testLoginUrl":
@@ -35701,8 +35684,6 @@ func (ec *executionContext) fieldContext_EnableSAMLPayload_samlConfiguration(_ c
 				return ec.fieldContext_SAMLConfiguration_attributeLastname(ctx, field)
 			case "attributeRole":
 				return ec.fieldContext_SAMLConfiguration_attributeRole(ctx, field)
-			case "defaultRole":
-				return ec.fieldContext_SAMLConfiguration_defaultRole(ctx, field)
 			case "autoSignupEnabled":
 				return ec.fieldContext_SAMLConfiguration_autoSignupEnabled(ctx, field)
 			case "testLoginUrl":
@@ -37939,8 +37920,6 @@ func (ec *executionContext) fieldContext_InitiateDomainVerificationPayload_samlC
 				return ec.fieldContext_SAMLConfiguration_attributeLastname(ctx, field)
 			case "attributeRole":
 				return ec.fieldContext_SAMLConfiguration_attributeRole(ctx, field)
-			case "defaultRole":
-				return ec.fieldContext_SAMLConfiguration_defaultRole(ctx, field)
 			case "autoSignupEnabled":
 				return ec.fieldContext_SAMLConfiguration_autoSignupEnabled(ctx, field)
 			case "testLoginUrl":
@@ -51814,8 +51793,6 @@ func (ec *executionContext) fieldContext_Organization_samlConfigurations(_ conte
 				return ec.fieldContext_SAMLConfiguration_attributeLastname(ctx, field)
 			case "attributeRole":
 				return ec.fieldContext_SAMLConfiguration_attributeRole(ctx, field)
-			case "defaultRole":
-				return ec.fieldContext_SAMLConfiguration_defaultRole(ctx, field)
 			case "autoSignupEnabled":
 				return ec.fieldContext_SAMLConfiguration_autoSignupEnabled(ctx, field)
 			case "testLoginUrl":
@@ -57480,50 +57457,6 @@ func (ec *executionContext) fieldContext_SAMLConfiguration_attributeRole(_ conte
 	return fc, nil
 }
 
-func (ec *executionContext) _SAMLConfiguration_defaultRole(ctx context.Context, field graphql.CollectedField, obj *types.SAMLConfiguration) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_SAMLConfiguration_defaultRole(ctx, field)
-	if err != nil {
-		return graphql.Null
-	}
-	ctx = graphql.WithFieldContext(ctx, fc)
-	defer func() {
-		if r := recover(); r != nil {
-			ec.Error(ctx, ec.Recover(ctx, r))
-			ret = graphql.Null
-		}
-	}()
-	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
-		ctx = rctx // use context from middleware stack in children
-		return obj.DefaultRole, nil
-	})
-	if err != nil {
-		ec.Error(ctx, err)
-		return graphql.Null
-	}
-	if resTmp == nil {
-		if !graphql.HasFieldError(ctx, fc) {
-			ec.Errorf(ctx, "must not be null")
-		}
-		return graphql.Null
-	}
-	res := resTmp.(string)
-	fc.Result = res
-	return ec.marshalNString2string(ctx, field.Selections, res)
-}
-
-func (ec *executionContext) fieldContext_SAMLConfiguration_defaultRole(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
-	fc = &graphql.FieldContext{
-		Object:     "SAMLConfiguration",
-		Field:      field,
-		IsMethod:   false,
-		IsResolver: false,
-		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type String does not have child fields")
-		},
-	}
-	return fc, nil
-}
-
 func (ec *executionContext) _SAMLConfiguration_autoSignupEnabled(ctx context.Context, field graphql.CollectedField, obj *types.SAMLConfiguration) (ret graphql.Marshaler) {
 	fc, err := ec.fieldContext_SAMLConfiguration_autoSignupEnabled(ctx, field)
 	if err != nil {
@@ -64303,8 +64236,6 @@ func (ec *executionContext) fieldContext_UpdateSAMLConfigurationPayload_samlConf
 				return ec.fieldContext_SAMLConfiguration_attributeLastname(ctx, field)
 			case "attributeRole":
 				return ec.fieldContext_SAMLConfiguration_attributeRole(ctx, field)
-			case "defaultRole":
-				return ec.fieldContext_SAMLConfiguration_defaultRole(ctx, field)
 			case "autoSignupEnabled":
 				return ec.fieldContext_SAMLConfiguration_autoSignupEnabled(ctx, field)
 			case "testLoginUrl":
@@ -71053,8 +70984,6 @@ func (ec *executionContext) fieldContext_VerifyDomainPayload_samlConfiguration(_
 				return ec.fieldContext_SAMLConfiguration_attributeLastname(ctx, field)
 			case "attributeRole":
 				return ec.fieldContext_SAMLConfiguration_attributeRole(ctx, field)
-			case "defaultRole":
-				return ec.fieldContext_SAMLConfiguration_defaultRole(ctx, field)
 			case "autoSignupEnabled":
 				return ec.fieldContext_SAMLConfiguration_autoSignupEnabled(ctx, field)
 			case "testLoginUrl":
@@ -75174,7 +75103,7 @@ func (ec *executionContext) unmarshalInputCreateSAMLConfigurationInput(ctx conte
 		asMap[k] = v
 	}
 
-	fieldsInOrder := [...]string{"organizationId", "emailDomain", "enforcementPolicy", "spCertificate", "spPrivateKey", "idpMetadataXml", "idpEntityId", "idpSsoUrl", "idpCertificate", "idpMetadataUrl", "attributeEmail", "attributeFirstname", "attributeLastname", "attributeRole", "defaultRole", "autoSignupEnabled"}
+	fieldsInOrder := [...]string{"organizationId", "emailDomain", "enforcementPolicy", "spCertificate", "spPrivateKey", "idpMetadataXml", "idpEntityId", "idpSsoUrl", "idpCertificate", "idpMetadataUrl", "attributeEmail", "attributeFirstname", "attributeLastname", "attributeRole", "autoSignupEnabled"}
 	for _, k := range fieldsInOrder {
 		v, ok := asMap[k]
 		if !ok {
@@ -75279,13 +75208,6 @@ func (ec *executionContext) unmarshalInputCreateSAMLConfigurationInput(ctx conte
 				return it, err
 			}
 			it.AttributeRole = data
-		case "defaultRole":
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("defaultRole"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
-			if err != nil {
-				return it, err
-			}
-			it.DefaultRole = data
 		case "autoSignupEnabled":
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("autoSignupEnabled"))
 			data, err := ec.unmarshalOBoolean2ᚖbool(ctx, v)
@@ -79763,7 +79685,7 @@ func (ec *executionContext) unmarshalInputUpdateSAMLConfigurationInput(ctx conte
 		asMap[k] = v
 	}
 
-	fieldsInOrder := [...]string{"id", "enabled", "enforcementPolicy", "spCertificate", "spPrivateKey", "idpEntityId", "idpSsoUrl", "idpCertificate", "idpMetadataUrl", "attributeEmail", "attributeFirstname", "attributeLastname", "attributeRole", "defaultRole", "autoSignupEnabled"}
+	fieldsInOrder := [...]string{"id", "enabled", "enforcementPolicy", "spCertificate", "spPrivateKey", "idpEntityId", "idpSsoUrl", "idpCertificate", "idpMetadataUrl", "attributeEmail", "attributeFirstname", "attributeLastname", "attributeRole", "autoSignupEnabled"}
 	for _, k := range fieldsInOrder {
 		v, ok := asMap[k]
 		if !ok {
@@ -79861,13 +79783,6 @@ func (ec *executionContext) unmarshalInputUpdateSAMLConfigurationInput(ctx conte
 				return it, err
 			}
 			it.AttributeRole = data
-		case "defaultRole":
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("defaultRole"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
-			if err != nil {
-				return it, err
-			}
-			it.DefaultRole = data
 		case "autoSignupEnabled":
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("autoSignupEnabled"))
 			data, err := ec.unmarshalOBoolean2ᚖbool(ctx, v)
@@ -93233,11 +93148,6 @@ func (ec *executionContext) _SAMLConfiguration(ctx context.Context, sel ast.Sele
 			if out.Values[i] == graphql.Null {
 				atomic.AddUint32(&out.Invalids, 1)
 			}
-		case "defaultRole":
-			out.Values[i] = ec._SAMLConfiguration_defaultRole(ctx, field, obj)
-			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&out.Invalids, 1)
-			}
 		case "autoSignupEnabled":
 			out.Values[i] = ec._SAMLConfiguration_autoSignupEnabled(ctx, field, obj)
 			if out.Values[i] == graphql.Null {

pkg/server/api/console/v1/types/saml_configuration.go

@@ -37,7 +37,6 @@ func NewSAMLConfigurationWithURLs(c *coredata.SAMLConfiguration, spEntityID, spA
 		AttributeFirstname:      c.AttributeFirstname,
 		AttributeLastname:       c.AttributeLastname,
 		AttributeRole:           c.AttributeRole,
-		DefaultRole:             c.DefaultRole,
 		AutoSignupEnabled:       c.AutoSignupEnabled,
 		CreatedAt:               c.CreatedAt,
 		UpdatedAt:               c.UpdatedAt,

pkg/server/api/console/v1/types/types.go

@@ -520,7 +520,6 @@ type CreateSAMLConfigurationInput struct {
 	AttributeFirstname *string                        `json:"attributeFirstname,omitempty"`
 	AttributeLastname  *string                        `json:"attributeLastname,omitempty"`
 	AttributeRole      *string                        `json:"attributeRole,omitempty"`
-	DefaultRole        *string                        `json:"defaultRole,omitempty"`
 	AutoSignupEnabled  *bool                          `json:"autoSignupEnabled,omitempty"`
 }
 
@@ -1659,7 +1658,6 @@ type SAMLConfiguration struct {
 	AttributeFirstname      string                         `json:"attributeFirstname"`
 	AttributeLastname       string                         `json:"attributeLastname"`
 	AttributeRole           string                         `json:"attributeRole"`
-	DefaultRole             string                         `json:"defaultRole"`
 	AutoSignupEnabled       bool                           `json:"autoSignupEnabled"`
 	TestLoginURL            string                         `json:"testLoginUrl"`
 	CreatedAt               time.Time                      `json:"createdAt"`
@@ -2076,7 +2074,6 @@ type UpdateSAMLConfigurationInput struct {
 	AttributeFirstname *string                         `json:"attributeFirstname,omitempty"`
 	AttributeLastname  *string                         `json:"attributeLastname,omitempty"`
 	AttributeRole      *string                         `json:"attributeRole,omitempty"`
-	DefaultRole        *string                         `json:"defaultRole,omitempty"`
 	AutoSignupEnabled  *bool                           `json:"autoSignupEnabled,omitempty"`
 }
 

pkg/server/api/console/v1/v1_resolver.go

@@ -3665,11 +3665,6 @@ func (r *mutationResolver) CreateSAMLConfiguration(ctx context.Context, input ty
 		attributeRole = *input.AttributeRole
 	}
 
-	defaultRole := "MEMBER"
-	if input.DefaultRole != nil {
-		defaultRole = *input.DefaultRole
-	}
-
 	autoSignupEnabled := false
 	if input.AutoSignupEnabled != nil {
 		autoSignupEnabled = *input.AutoSignupEnabled
@@ -3687,7 +3682,6 @@ func (r *mutationResolver) CreateSAMLConfiguration(ctx context.Context, input ty
 		AttributeFirstname: attributeFirstname,
 		AttributeLastname:  attributeLastname,
 		AttributeRole:      attributeRole,
-		DefaultRole:        defaultRole,
 		AutoSignupEnabled:  autoSignupEnabled,
 	})
 	if err != nil {
@@ -3725,7 +3719,6 @@ func (r *mutationResolver) UpdateSAMLConfiguration(ctx context.Context, input ty
 		AttributeFirstname: input.AttributeFirstname,
 		AttributeLastname:  input.AttributeLastname,
 		AttributeRole:      input.AttributeRole,
-		DefaultRole:        input.DefaultRole,
 		AutoSignupEnabled:  input.AutoSignupEnabled,
 	})
 	if err != nil {