ADFS: User information not synced properly when all roles are removed

Found in

EPiServer.CMS.Core 9.12.2

Fixed in

EPiServer.CMS.Core 10.1.0

(Or a related package)

Created

Sep 19, 2016

Updated

Nov 14, 2016

Area

CMS Core

State

Closed, Fixed and tested

Description

Step to reproduce

1. Install the Alloy templates and set up SSL for this site.
2. Follow the steps in this link to set up ADFS: http://world.episerver.com/documentation/Items/Developers-Guide/Episerver-CMS/9/Security/federated-security/
3. Create a user with access to edit mode.
4. Access the site as that user. See that all the information is updated in 3 tables:

tblSynchedUser
tblSynchedUserRelations
tblSynchedUserRole

5. On the ADFS server, remove that user from all groups having access rights to the site,
6. Log in again --> Access is denied.

Expected: Mapping user-role added into tblSynchedUserRelations table at step #4 is deleted.
Actual: If you check the tblSynchedUserRelations table in the Episerver database, you see that the user still belongs to the Editor group.
Note: If you add a new group to that user, you see a new row is added to these tables: tblSynchedUserRelations and tblSynchedUserRole.