We are running into an issue where users with long email addresses are not able to log into our application using SSO. The issue we're seeing is with the External_Id.
I saw some older posts here were people resolved this by customizing their IDP component or implementing a cumbersome workaround. As a best practice, we don't want change the component, thinking it would be better solved by updating the component to follow the standard of having a length of 254 characters in the relevant fields.
Dear component authors: Are there plans to update this component to bring these fields up to the RFC standard lengths? Or should we proceed to customize against our standards?
Other posts I found linked below - there may be others:
https://www.outsystems.com/forums/discussion/71802/idp-idp-user-with-long-email-not-able-to-login-to-the-application/
https://www.outsystems.com/forums/discussion/66401/idp-username-max-length-mismatch-on-samlmessage-log-entity/
Hi Julie,
Looking at the IdP v5.0.14 source code, I can give you a precise answer on where this limit comes from.Root cause
The limit is not in the IdP component itself. The component's UserData.ExternalId field is plain Text with no restrictive length. The bottleneck is the platform's ossys_user.External_Id database column, which is constrained to 36 characters (GUID-length by design). This is a platform-level schema constraint that no Forge component can change.
The v5.0.14 release note about "improved session registration code to prevent truncate errors" means they added error handling so the truncation no longer crashes the login flow. But the underlying limit remains, because the ossys_user table is owned by the OutSystems platform, not by the component.Asking the component authors to "update the field to 254 chars" is not in their power to do.
If you want the platform to support longer External_Id values, the right channel is https://www.outsystems.com/ideas/.
Practical workaround (no component customization needed)
The IdP's Config_UserMappings lets you map SAML claims to user fields independently. The key insight: ossys_user.Username supports up to 250 characters, which comfortably fits RFC 5321 email addresses.
Reconfigure your claim mappings in the IdP backoffice:
1. Map the long email address to Username_Attribute instead of ExternalId_Attribute. This writes to ossys_user.Username (250 chars).
2. For ExternalId_Attribute, use a shorter identifier from your IdP (employee ID, short UPN) or leave it unmapped if your setup doesn't require it.
This is purely a configuration change. No OML customization, no component forking.
Let me know if the mapping reconfiguration works for your setup.