When User Profile=Dynamic and SAML2 auto-federation is enabled, and using the SAML2 module/chain, the newly provisioned user ID is either the auto-federation attribute or the NameID value (if useNameIDasUserID is enabled) depending on the SP configuration.
However, when the SAML2 Node is used, there are 2 outcomes:
- Account exists
- No Account exists
In the 2nd outcome, you can link it with the 'Provision Dynamic Account' node. This node will create a user under a random ID though (ignoring SAML2 config)
The request is to enhance the 'Provision Dynamic Account' node to support auto-federation as it was possible with the SAML2 module/chain.
We'd need to make SAML2 config and assertion available in the AccountProvider interface:
Default implementation used by the 'Provision Dynamic Account':