GitLab Backend Pairing, 3 May 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: BE Pairing - 20230503 - Keep SAML Identity when deprovisioning via SCIM

Description

In this session, we pair up on keeping SAML identity when deprovisioning via SCIM

https://gitlab.com/gitlab-org/gitlab/-/issues/379149

A

Nice, okay, so we're just talking about this trying to understand the lay of the land here for this issue. So we have skim and we have saml. Skim is used to create and remove users so skim with de-provision, a user. So say we say: okay, this person is no longer at our company or in our department. We want them removed from git lab. We remove them from this system over here this skim system, and then we have skin set up with Git lab and so that syncs over to gitlab and removes the user from gitlab.

A

um But it looks like what it really it doesn't remove their skim identity. It sets it to active false and then it deletes their saml. Identity are different, uh different systems, so the problem with that is that if the user is reprovisioned with skim so say we have a boomerang. The person comes back to the company or something then they're reprovisioned, but there's no saml identity. I, don't know why that would be. But that is what this issue is claiming.

A

um I, don't know what a gitlab database password is.

B

C

B

C

Access to the actual GitHub database to get a find a way to reprovision that user.

A

Oh I see so not a data but not a password to the database, but like uh a path. A user login password.

D

Like maybe, if they've never set their account up- and they only set it up through this method than if they get removed, they basically have no way to log in.

A

Yep, okay, that makes sense yeah and it's um it's interesting. That's one thing about our auth systems that was kind of new to me or unexpected, because my the old system I worked on was different. You can have a password and be a single sign-on user and get Lab at the same time.

A

um So, but you don't have to have a password okay, so this is saying: let's just leave the saml identity alone. Whatever thing is deleting a saml identity, let's just leave it alone when they're deep version via skim.

A

um So we remove all their memberships.

A

So we just have to find where this deletion is happening and stop doing it and then update any related tests seems doable yeah, um so I'm going to create a branch over here is my how's, my size, thicker, smaller.

B

Perfect same yeah, it's fine.

A

Okay, okay and keep them all identity and I truly have no idea where this code is so it will be an adventure together, as we figure out where it is.

B

A

Oh, there wait hold on somebody made a merger, Quest uh-oh, and we had to change paths. Who is this person? It's nobody.

D

Oh, it's a hackathon contributor. That's.

A

Cool okay: well, let's look at it together and then maybe.

D

I was really like um when we get people that are Community contributors or my team, we don't get them often enough and they want more. Thank you.

B

A

Yeah, this is cool. I, think that there might have been a tag seeking Community contributions on this.

A

um So far, I don't know if this is right, because what I expected to see was that we were deleting their skim, their Sim identity- and this is just not updating it to be inactive, but maybe that's the same thing.

A

um This is the D skim, deep provisioning service. This is the group skim deep provision. You could even have instant skim or Group scam.

C

Yes, this is actually checking to the identity, to don't change its active status.

A

C

That's different.

A

That is different from the um from what the issue said, but also maybe the issue wasn't 100 accurate.

A

um So maybe we should just open this file. This is good. We can let's just open this file and see what it's telling us.

C

uh Because because you share the link to the EMR.

A

The Mr yes I, will do that in the zoom chat chat. Here. Oh.

D

Wait do it in the slot, because you can't copy paste from Zoom chat.

A

Okay, I'm just reopen back end pairs back end there. There we go uh sweet, so um that's the Mr and then the issue is here: it's possible and this happens a lot I find right. Where there's an issue somebody wrote and like.

A

If you take it too literally, sometimes you don't end up making the correct um change, but because we remove the saml identity and we set skim identity active fall. So we still want that right. We still want the skim identity to be active false. What we want is the saml identity to not be deleted.

A

um And I don't know if we have tests uh for there being a saml identity and a skim identity.

B

um So, let's look at this really quick.

C

So it's kind of the that those changes are not the most updated because looking at the Mr description.

B

C

Contributor is still working on this and.

C

And and and the the first.

A

C

They covered is what they weren't able to test the scheme API because it wasn't working locally, uh so they made the change without testing anything, and then they were able to set up something and I, don't know where they are at now.

A

Okay, that's good that you read the Mr description. I should have started there too.

A

um Yeah and I believe, if you look at her socks on skin, they mention Azure, OCTA and One login. If anyone ever needs to set up skin I recommend OCTA, it's so much easier than Asher. um I have set up Azure, but it's really a long time.

A

um Octa is a lot more user-friendly just for like the average developer use case, um so maybe they were, it seems like they were. Maybe trying some other approach.

A

They were using simple saml, o yeah, this doc yeah, so GDK has documentation on stanl.

A

Are different so it does seem like. Maybe this contributor is a little bit confused about the difference between sample and skin.

A

The skin maybe yeah I'm using it here, um which would make sense that maybe that, because they weren't able to test it, it would be a little bit confused about how these two systems are working together.

A

um uh But Samuel saml is like, uh like skin, is a push-based right, so skim users get de-provisioned provision and de-provisioned by this other system and saml is more like when I want to log into gitlab. My account will be provisioned via this saml provider over here, but it's not like a directory sync.

A

A

Do folks think that we should just try to come up with something and give this person suggestions on their Mr uh or how should we proceed.

B

This is four days ago.

D

Yeah I mean I've had an okay lock with um giving like hey here, I, see you're running into issues.

B

D

Like here's, some steps to unstick yourself or if the patch might be helpful for them, that could be something that we do.

D

Is it safe first first contribution, because if not, then they may already be um it's.

C

D

To our development workflow and then maybe they won't be shocked if they get just like feedback from from folks, like.

C

I did see them in the past, so they're, not new new.

A

Yeah and it looks like yeah, it looks like already been talking to them about this, so they were like engaged like they opened Mr four days ago,.

A

But okay, great people have already been commenting on this.

C

Oh okay, yeah go a little bit down.

C

um uh I have an MR and it passed the CI. It's ready to be reviewed. The only problem is that I can make the scheme working with simple.

C

Yeah but I.

B

C

I the changes, look, they do something different.

A

Than what is described, yeah.

C

Because they're not updating the scheme uh activity um active in active status.

A

Yeah, which I don't think, is what we want right. My understanding is, we still want the skin identity to be.

B

A

We want the saml identity to remain and I I'm, guessing that whatever calls this de-provisioning service uh deletes the saml identity as well. It just happens outside of the service. I mean I, think it might be.

D

A good thing to like add that, as a like, a like a this looks like this might not be exactly what the issue asks for.

A

Add that you mean like as a comment or um yeah I think so okay, but they usually able to point the person to where they should look. um Yeah.

D

Yeah I feel like we can do some like digging in the code and kind of be like here's, where I would start and um maybe give them some links.

A

Yeah, okay, I, like that idea, um yeah. It's always a tricky balance like when we're viewing code. uh I guess like if it was an internal person, I'd be more Lo-Fi to be like I. Don't think this is right, like you should just revisit this, but since they're a community contributor, you know I want to be a little bit more helpful and like pointing them because they are doing us a favor. Their.

B

A

um Okay, so maybe what I will do is just quickly graph and see what calls this that's.

D

What I would do and see where that service is being executed from and maybe there's some worker call back something.

B

Yeah, okay, so.

D

It's in the API.

A

The API online 30 here.

A

I need to think it's full screen here, patch, deeper vision.

C

Relate the provision.

A

Mind is our identity, interesting, it doesn't skim identity.

B

A

That's her so delete.

A

So it doesn't. Nothing here, obviously, is deleting the saml identity right, because it's just finding it. It raises the not found error if it doesn't find it, and then it calls patch D provision which goes to that deep provisioning service.

D

I wonder if there's like an after mid or something on this give identity model that maybe is doing something funky I, don't know it's really weird.

A

Or the base deprovisioning service does something: no, it doesn't, um and after or maybe system block or something.

B

A

I, don't know where system block is.

A

I bet that the um devise.

C

uh Scheme identity model doesn't have anything strange.

B

C

Belongs to user.

A

This is always the fun part of anything right trying to figure out where it is gonna happen, um trying to think of strategies for figuring this out. I think it would take too long for me to set up skim and Samuel locally, because I don't have those set up right now in order just to manually test it, um but that is something I like to do. Sometimes what.

D

Is this the user does system block, do.

A

That I don't know I'm guessing. uh Let's see, I also have to look this up. How do you and Ruby, where do you find where method is to find there's if I look on stack over a world, it's something I've looked.

D

At the guy well,.

A

That's what I did? No, you know.

D

A

A source location is the method, but there's something. Let me just go to the Google silver location Ruby. Oh there, it is my purple link, um so Source location. There we go.

C

It's an event system.

A

C

Yes, inside the user model.

B

D

Transition active to all.

C

That, oh and look, who made the last change to that heaven system block.

A

C

It's Jesse young.

A

Oh I swear I've, never heard of the method. I.

D

Always smell if I'm, like I've, never seen this code before a day in my life and I'm like wait, either I merged it or I wrote it yeah.

A

Well, there's but anyways. This is a thing. User instance method system block Source location. Well, so in this case it was a little bit, um not the right answer or like it. Wasn't that helpful, because it's part of coming from this date machine.

D

um But that would have been yeah. That's why I wouldn't have been able to find it with def system block. It wouldn't come up.

B

D

Yeah yeah, so that just seems like it blocks like it doesn't touch the saml stuff. Well,.

A

Let's see so it goes to deactivated that.

D

Ldap block looked like it just.

C

Well, that system block event is only used twice in saml and skim.

B

A

um So, are you saying that.

B

Oh interesting.

A

It says it should be used for l.blocked users, but foreign.

A

Active makes you ldap, blocked and deactivated makes you all that blocked. Oh! Is that because we don't want somebody to be have saml and ldap at the same time or skimming on black Lab. At the same time,.

B

C

Status is blocked, is used for ldap Samuel and scheme blocked.

D

Users, so there's a really weird method in.

D

I, don't know, I see it in the saml code in um this method,.

D

A

D

In which hat? Do you want me to put and I put it in the chat? Oh favorite,.

B

User method: okay,.

D

I, don't know anything about what this code does um the overrode find user Where My Views.

B

Are called from oh boy, this looks complicated.

A

I have a one pointer well.

D

It doesn't look like the de-provisioning service actually does anything to Samuel, but it looks like maybe, if I'm reading this right in the saml module when the user is being found. If they're not in the required group, it blocks them.

A

And that's I, don't know dear user and required group.

D

And if not, if.

A

They're not in the.

B

D

They're persistent, it blocks them.

A

But the I mean again, this might be me, look like paying too much attention to the issue, but the issue claims that we're.

D

A

Sample identity, we're deleting the same identity and, as a result, that's causing problems.

D

um That's another silly question: where what model, what class or what file name is where the same old identity lives.

C

Maybe the issue is that when you, the provisional schema identity, both scheme and saml are deactivated, but when you reprovision, only the scheme is activated and on this saml.

A

um So it's not that it's deleted! It's that it's not reactivated and.

C

Maybe that's why I think that on the issue they actually mean that gitlab database password, because you can go to the table and set the Boolean field to active. If it's a Boolean.

A

Okay, well maybe we should look at the skin provisioning service, there's not a reprovision. Now there is a reprovisioning service, interesting, so there's provisioning and then there's really proficient.

A

um Let's see what the difference between skim, provisioning and skin repositioning is well.

A

Oh success, responsive existing identity, oh, but it's persisted, but it's not checking whether it's active.

B

A

And this is base provisioning service.

A

B

That's wrong: yes, where's identity defined here, existing identity.

C

It creates the identity.

A

B

A

I, don't need you there, but where is identity.

D

Oh, it's a identity is the same thing. Wait it uh it's a method in there.

C

uh Yeah and they try to find the existing identity, otherwise they build the schema identity.

A

C

A

I'm sorry go on, oh I was gonna, say they're finding it, but nothing in here is checking whether it's active or not.

C

Because when they build it, they set it to active.

A

But what if it's already there, but it's inactive like this- is actually re-provisioning.

C

Oh I, don't think uh when you do that I think you go. You use the reprovisioning service, so I wonder why they try to search for an existing scheme. Identity in here.

A

And we can look at where uh the reprovisioning service is called.

A

Because it's possible that, let's see so here, it is an API online 95.

A

The reprovision, where are you called new Provisions, so there's just a reprovision method in the API I, would guess that sometimes the provision and point is called instead with one one is actually being um reprovisioned.

A

Where are you here? We go so post request, right, I, don't know like I, don't know exactly how these things are wired up, but my guess would be that um some some skim services are not smart enough to know to call the reprovision endpoint. They call the provision endpoint, whether it's a new user or a reprovision.

B

D

Yes, okay, I see what you're I see what you mean and in the provisioning service. If the identity is existing, it just returns success and doesn't do anything.

A

That's the theory.

D

um Yeah return success response with existing identity, yeah.

A

And then all that text is if it's persisted yeah.

A

um It's a it's a guess: I mean I, don't um without being able to test it.

D

Well, if we look at this provisioning service and see if there are tests, if we write a test that says like I, don't know the provision service within existing something and if it's I, don't know how to like verbalize this like pick it out. Instead, it's inactive whatever I said it's active ball, so run this thing and see what it does.

D

A

B

A

Oh interesting, it does not create the stamel identity.

C

So it has to be created somewhere else.

A

D

A

Oh yeah, that's, oh that's only if or if the test is organized correctly. It's for an existing user.

D

Yeah I feel like if the provisioning service is called an existing user, but that user has been deep, provisioned.

D

Maybe they're like reprovisioning service needs to be called on it instead, like is that bad I don't know no.

A

It's not the worst I mean I.

D

Feel like that would be the safest like if this thing is being called I, I I'm, not sure when this provisioning service might be accidentally called on an existing user.

B

A

uh Create skin I did I was gonna, see if Samuel is referenced in here. There's no reference to Sam one here, but memory provisioning service test, but.

C

It it uh there's not even a Samual identity.

C

It uh yeah because I did try to look for some little identity model or something something like that, but I couldn't find it. I only could find a sample provider.

A

I think it's identity, at least according to this. What line 142 here? um This is saying this is the same identity, so I think it's the identity model.

A

And then maybe they're Maybe there's some attribute that lets. You know that it is a saml identity.

B

C

uh Because I I try to look for some underscore identity, but if I try to look for Samuel space identity, there's an identity, Linker.

B

Identity maker.

A

I think its provider is named, saml I think it's like an identity record that has a provider value of saml, but I would have to test that locally to be sure,.

B

B

C

The identity model belongs to a summer provider.

A

The identity model belongs.

B

A

In some cases, I think other times, there's other providers.

C

A

It's theoretically something that I should know about, but I, don't um so I'm intrigued by the fact that this test exists because I'm like if so provisioning skin provisioning, does not create a saml identity. So what does there's no reference to saml identities in the reprovisioning service and then I guess we haven't looked at the D provisioning service specs, but I. Don't yeah! There's no reference to family in here either.

C

Oh because identity is not the user, I mean it's two separate things right.

A

Skim identity and identity.

C

No identity and actual user because um creates a user, because the scheme provisioning service creates this scheme, identity and a user. If the user doesn't already exist.

B

C

But it doesn't create the summer identity. It.

A

Doesn't yeah what creates the thermal identity.

A

um Is this is the identity passed in from the base provisioning service? This is the wrong. This is a great one, so um identity, oh wait! Where is identity coming from here again? There's a method isn't there. This is a schema.

B

A

Yeah I just was like. Is this the same like anything? No, it's just a skim identity.

B

B

A

Because the reprovisionings.

A

Where is identity defined here? Oh and initialize,.

B

Reprovisioning service I.

A

Guess they can assume that this is a skim identity, not a saml identity.

B

D

Okay, I think maybe it might be um the classes group saml identity hold on.

C

Groups, identities.

D

If you look at there's a user's Factory that has a trait called Enterprise user created via saml and then let me see hold on, let me look at that trait there's another trait called Enterprise user created via skim, and let me see what this Factory is talking about.

D

Like I'm digging Into the Depths, the bowels of.

B

Something I have no business being.

B

D

I will hold on. There has got to be a factory for this right.

A

And user, it's a trait.

D

There's a trait that's called Enterprise user created via saml, and that trait has another Factory being created inside of it, which is creating something called a group. Saml identity, yeah, but I was trying to figure out where that, where that factory is yeah.

B

But I feel like I'm close Maybe.

B

D

The group has many groups same old identities,.

B

On the factory.

D

Oh, it's a class identity. What is going on right now.

A

Yeah, that is not what I would expect.

C

I thought oops Samuel identity is a method on the member model, okay or project member model or.

D

Try this model app models, identity.rb.

A

Yeah this one, so this is the one where we think a saml identity is an identity with a provider of Samuel.

D

C

uh There's a group saml identity, Factory used for the specs that creates an identity class and sets the provider to group underscore demo.

A

C

uh I don't know if this is really related, but nice and the link on Slack Instagram.

D

Yeah, that's where I was I was back group Samuel and then the I think we're in the same track. The identity model is the one that that is referencing, maybe there's an ee version.

A

C

The reason ee version, which has this summer Pro, belongs to Summer provider.

A

A

A

So um group examples.

A

D

I, don't know if this found us anything but I feel like this is what they're talking about I, don't know where this is being possibly modified.

A

The identity, yeah record yeah that I don't know either.

A

It will and I don't know where it's being modified as it relates to scam right like so. If something happens with skin uh are those happens with Samuel? Do we do something to the skin, identity and I? Do think this is a good uh reminder that we heavily use callbacks and get Labs gone face, which really creates.

D

A

Fun things that's.

D

What I was wondering if there's like some callback, that's somewhere, that we're not catching that's like saying something: got modified and I, don't destroy yourself or something.

A

Yep I would not be surprised.

B

Oh, what did you.

C

There's, oh I'm, maybe not there's an identities, controller that creates the identity.

A

C

uh Yeah app controllers, admin, identities, controller, okay,.

C

uh uh Oh and there's also, but this is a Kerberos identity.

A

Difference yes,.

C

I think that's different. There's an atlassian one.

C

A

One again I remember the supposed thing we're fixing is something that happens via skim provision and D provision So in theory. If the issue is right and we just followed the code through that path, we should find it but I guess we already tried that didn't. We.

D

um Yeah, the only thing I can think of so identity.update. The identity we've found is delegating.

D

Oh okay, the basic provisional Services called with the identity.

A

I'm, remembering something I've done a little bit with skin and I'm, remembering something- and it is what we already found is that in the API kind of API. Why is that not?

A

Is it ee yeah? It is.

A

um Maybe that's maybe that's fine. Maybe these are just hosted. I was like. Are we looking at the wrong endpoints? That's what I was thinking um but I think we're looking at the right thing before yeah. This is V2 API again.

B

A

Find user identity? Oh.

A

Find your identity, so this is the saml identity, that's being passed in.

A

They go to the oh, no, it's it's skin identity, I, don't know the naming situation here is really a challenge. Okay in terms of we're dealing with skin identities and family identities, but the word identity is used a lot yeah. um It's really. It's.

B

D

Of just join me for a little bit my area of code, everything is called search service.

B

D

See I see what you're seeing so this deep provisioning service being called from the API is being passed, an identity in the initialization method. The identity appears to be this skim identity.

A

C

But since we're trying to find that saml identity, why don't we go the other route? Try to see how the scheme API you use to create an identity and see where they're, creating the saml identity.

B

A

um Although I the tests for the provision were saying that it didn't create a same identity, oh but I, guess that was for an existing user. Wasn't it.

C

A

Okay: okay, um how do you want to go about finding that like? Do you want to just look at the code here? Do you want to run a test.

C

uh I would write to see the end point and excuse me.

A

Okay, so create a screen user. This is find and authenticate group. That's fine! That's.

C

A

um And then it calls a versioning service and.

C

We know that the provisioning service won't create the same identity for an existing user, but.

A

If created in the only okay, creating the only existing user.

A

And existing member create identity and member.

A

But then it says, identity, save and identity is defined.

C

A

Group skin this is a skim identity.

A

So it's only game: identity, oh create user and member. Let's go to that method.

B

um Users saved.

C

So it's creating a user.

A

It's creating a user, but there's no, like the word. Sampled not appear in here I'm.

C

Going to provide up above a little bit.

B

C

Membership role, someone provider in the user, params, okay, I I- think that's the one because it's setting the provider id for the xaml.

A

Oh, so it's just setting it on the user.

C

C

What's Samuel underscore provider id.

B

So Pro minder I think okay.

D

Just four Giggles I look at the issue the zendes ticket to see what that workflow looked like I. Think that's helpful or not. Oh,.

B

I, like that, okay.

D

The person I've used gitlab using their company email prior to the implementation of saml. They have now come back to using gitlab and have lost their two-factor off and therefore cannot register back into the group.

A

They've lost a few Factor. Ah That's like a totally different thing. I feel like.

D

They were removed from the group, maybe they're, using gitlab prior.

D

I don't understand this did not help me.

A

um This this line that Marco's previous thoughts kind of led us to is interesting. So group saml identity is we're, not family provider. I do you know.

D

Yeah, so it's basically the identity class over the same old provider. Id is populated.

A

A

Yeah, so we still don't know where the identity, like a database record for an identity, is being created for this user, but it feels it feels like it has to be in a callback.

A

You know I'm just looking for the word identity in the class.

C

And that's inside user.rb right.

A

Yeah but it's the ee user, um let's just look at regular user.

B

A

Oh auto save true.

B

A

Yeah I don't see anywhere in here where a family identity is being created just to skim identity still.

A

We've looked in base provisioning service right.

B

A

Not occur in there.

A

um Another thought I'm: having is.

A

Our we're using Omnia saml um Ruby Samuel, like I, wonder if this code is happening in a library or something.

A

That's one thing that really trips you up about our off code frequently, is that a lot of it is brought in Via libraries, and so it's like difficult to tell.

B

Where it happens, yeah that makes sense.

B

Okay, so there's a user's build service that I don't know who's. That.

B

Identity programs build identity.

B

C

Nothing I was just wow.

B

B

All right hold on.

C

Oh, an user has many scheme identities.

B

C

Surprise, oh maybe this is.

B

B

C

Have a look at this comet.

C

Because I found a comment from three years ago: that's saying: separates Kim identities from saml.

A

Okay, where did you paste.

B

C

Oh yeah I just I'm, just using a code lens uh I'm trying to get to DMR.

B

D

Hold on there is: oh, you do have a user, you have a live in a user Library, okay,.

D

I'm trying to like see there are a lot of code. That's in here that looks like it's like, not quite where I would expect it to be in libraries, there's a add or update user identities method. That's in a library that if I was looking at this I might poke around in in there.

B

Oh yeah, all right, I.

D

Don't know what all this is doing, but this looks very suspicious.

A

um Very suspicious, so where is this called I? Don't know, find an update.

A

D

This is, this is group saml user, which seems.

B

B

D

B

And now the initial energy.

A

Like too many responses.

B

A

B

Okay, everybody.

D

There might be a different, deep provisioning services. Are there.

A

D

There's instance and there's group okay, the group one: oh.

B

I wonder if that.

D

B

Be what's most group access.

A

Memories the base the base depositioning or just the regular group.

B

D

Me look: I've looked at the base, I'm just trying to see like where.

D

D

Saml provider id stuff is being like kind of touched and in the group provisioning service Under the Skin folder. It's like skim group provisioning service that one is setting some sample provider id from somewhere. So I'm, like maybe I, wonder if we were looking at like.

B

The wrong visioning service.

D

And then maybe the other de-provisioning service does more stuff remove.

B

D

Don't know if we're helping you at all, but at least we're all thinking through code.

A

I'm, like it's like uh I like it, this is the kind of thing where if I was looking at it alone, I'd be like. Oh, why did I pick up this one player I.

B

Thought it would be one pointer to me.

A

I know well, I think it could be a one pointer to Drew who created.

C

A

And I think what I'll do after this pairing session is probably just ask him if he happens to know exactly where this happens or.

D

Yeah I think what school.

A

D

What I've noticed is like, especially if you're doing the community contributor issues you have to almost provide like an overabundance of which files you want them to look at yeah I I mean I. Look at this I I. Try to look at the repository before I got a job here. I was like whoa.

D

Oh no, I don't even know where to find anything, um so maybe the people that have contributed before they're, probably in a better State and they feel more like I, do now, but even so, like all of us, are kind of yeah we're still having a little bit of problems like fighting for.

B

A

Yeah I think, and it might be that there is also some vague, not even vagueness about like where to look but.

B

Animal identity.

A

Like this feels very clear to me, but then you're.

D

Right, it's Fundy provision. We've removed the user from all group project memberships, so.

A

That's members destroy yeah.

D

I wonder if that's maybe where it has that destroy service, doing.

A

That's I'm over here, looking at it um and also there's ee app services.

A

So remember cleanup group identity where in them in the ee members destroyed service.

A

C

And we found it one minutes before the hour. 45.

D

Minutes later we got to what we needed. That is good. That is good pairing.

A

That is a good pairing. Okay, so um I think the action element is to get a permalink to this line and ping the community contributor- and let them know that, like it's saml, this is what needs to change, not uh the skim, identity, piece and I'll. Let them know that it took three experience: Gate lab developers an hour to find my phone, so they don't feel bad.

C

Two and a half okay.

D

Hey uh I'm glad we found it. I was like somewhere, like the person have not written up. This issue like I've, worked with Drew before, and he knows what he's talking about so I'm like well clearly yeah somewhere um found.

B

D

I'm glad we found it so um cool I know we're at the end of time, I'm gonna stop the recording.