Scenario
An IdP schema update rolls out and later Grafana users can log in but lose access to the teams and folders they previously owned.
A Grafana SSO login succeeds and folders vanish because the IdP moved team claims into nested groups while the role mapping still reads the old flat attribute
Authentication works, yet authorization collapses because the downstream mapper still expects the earlier claim shape.
What to check first
- Identify the primary failure signal in the The User Arrived With Valid Claims in a Shape the Mapper No Longer Understood scenario.
- Separate visible symptoms from the underlying technical dependency.
- Describe the safest recovery path and the follow-up prevention work.
Checking checklist
- Summarize the current impact and the last known change.
- Collect direct evidence from logs, runtime state, and configuration before changing anything.
- Separate immediate recovery from permanent prevention work.
Recovery and prevention
Inspect the live token claim structure before recreating teams or changing login config.
Questions worth viewing together
Community-field security problem inspired by Grafana community patterns where role mapping broke after team claims moved to a different OIDC structure. Post-login authorization failures often come from claim-shape drift after identity updates.
Teams often blame sync jobs when the mapper is just targeting the wrong attribute path.
OIDC-backed RBAC should be retested any time the identity provider changes claim structure.
Similar cases seen in the field