From 93f28e378fdb23850b698de6e3a269918edd097f Mon Sep 17 00:00:00 2001 From: "Emil H. Clausen" Date: Wed, 17 Jun 2026 11:51:04 +0200 Subject: [PATCH] feat(aad-aws-sync): include UserId in query response --- .../Infrastructure/Api/System/IAadAwsSyncCapabilityQuery.cs | 5 +++++ .../Persistence/Queries/AadAwsSyncCapabilityQuery.cs | 3 +++ 2 files changed, 8 insertions(+) diff --git a/src/SelfService/Infrastructure/Api/System/IAadAwsSyncCapabilityQuery.cs b/src/SelfService/Infrastructure/Api/System/IAadAwsSyncCapabilityQuery.cs index 87d1d435..57096143 100644 --- a/src/SelfService/Infrastructure/Api/System/IAadAwsSyncCapabilityQuery.cs +++ b/src/SelfService/Infrastructure/Api/System/IAadAwsSyncCapabilityQuery.cs @@ -19,6 +19,11 @@ public class CapabilityDto public class MemberDto { public required string Email { get; set; } + + // The member's identifier. For regular users this is their UPN, which lets + // aad-aws-sync look the user up in Azure AD directly instead of guessing via + // email — correct even when the user's UPN differs from their email address. + public required string UserId { get; set; } } public class ContextDto diff --git a/src/SelfService/Infrastructure/Persistence/Queries/AadAwsSyncCapabilityQuery.cs b/src/SelfService/Infrastructure/Persistence/Queries/AadAwsSyncCapabilityQuery.cs index 8ab020f8..f229a09b 100644 --- a/src/SelfService/Infrastructure/Persistence/Queries/AadAwsSyncCapabilityQuery.cs +++ b/src/SelfService/Infrastructure/Persistence/Queries/AadAwsSyncCapabilityQuery.cs @@ -37,6 +37,9 @@ public async Task> GetCapabilities() // Azure object id, so resolve the (synthetic) email from the Member record. // Fall back to UserId for memberships without a matching Member row. Email = emailByUserId.GetValueOrDefault(member.UserId, member.UserId), + // UserId is the authoritative identifier (the UPN for regular users); + // aad-aws-sync uses it to resolve the user in Azure AD directly. + UserId = member.UserId.ToString(), }) .ToArray(), Contexts = awsAccounts