Problem:
fter renaming a user in LDAP (e.g., changing the last name), the display name in the Wire application remains outdated, while other integrated applications (e.g., Email, OpenDesk) show the correct updated name.
Environment
- Integration: Wire is integrated via SSO (Single Sign-On).
- Configuration: No SCIM (System for Cross-domain Identity Management) client/connector is configured or available in the environment.
Cause
In a setup where only SSO is used without a SCIM client, there is no automatic synchronization of user attributes (such as displayName, givenName, or sn) from the identity provider (LDAP/Keycloak) to Wire.
Wire relies on a unique identifier (e.g., sAMAccountName or uid) to map the SSO login to the correct Wire account.
If the primary email or other identity attributes are changed in a way that also modifies this unique identifier (the “linking attribute”), the following happens:
- The link between the LDAP user and the existing Wire profile is broken (“unlinked accounts”).
- Because there is no SCIM to “push” the new name to the old account, the outdated name persists in the existing Wire profile.
- Depending on the configuration, the user might even be treated as a new user upon the next login.
Resolution / Workaround
Since there is no automatic attribute synchronization without SCIM, the following applies:
- Avoid changing the unique identifier: To maintain the link to the existing Wire profile and its history, the attribute used for SSO mapping (e.g., SAM account name / UID) should remain unchanged.
- Manual Update: If the name must be changed and no SCIM is available, the display name must be updated manually within the Wire administration/user settings (if permissions allow).
- SCIM Implementation: For automatic synchronization of name and other attributes, the implementation of a SCIM client is required to bridge the identity provider and Wire.