Django allauth SAML配置问题：登录重复创建'user'需改为新建唯一用户

1. 修正属性映射配置 #

首先调整SAML配置的attribute_mapping，让SAML返回的属性直接对应到Django User模型的字段，同时用SAML提供的唯一标识（如http://schemas.auth0.com/clientID）映射到username字段，保证用户唯一性：

{
  "idp": {
    "name": "example IdP",
    "slo_url": "https://wac.example.com/sso_cond2fa_2023/SingleLogoutService",
    "sso_url": "https://wac.example.com/sso_cond2fa_2023/SingleSignOnService",
    "x509cert": "-----BEGIN CERTIFICATE-----XXXXX-----END CERTIFICATE-----",
    "entity_id": "urn:dev-123.us.auth0.com"
  },
  "advanced": {
    "strict": false
  },
  "attribute_mapping": {
    "username": "http://schemas.auth0.com/clientID",
    "email": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
    "last_name": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname",
    "first_name": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname",
    "email_verified": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
  }
}

2. 自定义SAML适配器 #

在项目任意app（如accounts）下创建adapter.py，通过重写适配器方法强制填充User字段，并控制用户创建逻辑：

from allauth.socialaccount.adapter import DefaultSocialAccountAdapter
from allauth.socialaccount.models import SocialAccount

class CustomSAMLAccountAdapter(DefaultSocialAccountAdapter):
    def save_user(self, request, sociallogin, form=None):
        # 从SAML返回的属性中提取数据
        saml_attrs = sociallogin.account.extra_data.get('attributes', {})
        user = sociallogin.user
        
        # 强制填充User核心字段
        user.username = saml_attrs.get('http://schemas.auth0.com/clientID')[0]
        user.email = saml_attrs.get('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress')[0]
        user.first_name = saml_attrs.get('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname', [''])[0]
        user.last_name = saml_attrs.get('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname', [''])[0]
        user.is_active = True
        
        user.save()
        return user

    def pre_social_login(self, request, sociallogin):
        # 需求分支：
        # 1. 若要每个SAML用户对应唯一Django用户，取消下面代码注释
        # try:
        #     social_account = SocialAccount.objects.get(
        #         provider=sociallogin.account.provider,
        #         uid=sociallogin.account.uid
        #     )
        #     sociallogin.user = social_account.user
        # except SocialAccount.DoesNotExist:
        #     pass
        
        # 2. 若要每次登录都创建新用户，保留此方法为空即可
        pass

逻辑说明： #

• save_user：直接从SAML的extra_data中提取属性，覆盖User字段，避免数据仅存于extra_data。
• pre_social_login：根据需求选择是否复用现有用户——注释掉的代码用于匹配已有SAML账号关联的用户，空方法则强制每次登录新建用户。

3. 配置使用自定义适配器 #

在项目settings.py中添加配置，指定自定义适配器路径：

SOCIALACCOUNT_ADAPTER = 'accounts.adapter.CustomSAMLAccountAdapter'  # 替换为实际app路径

4. 验证效果 #

重启Django服务后，进行SAML登录：

• 查看Admin后台的User模型，确认username、email等字段已被SAML属性填充。
• 根据选择的逻辑，验证是否每次登录新建用户，或同一SAML用户仅对应唯一Django用户。

内容的提问来源于stack exchange，提问作者brianray