Managing SSO User Account Duplicates and User Deletion – DataHub Customer Support Portal

Area: Deployment Issues

Sub-Area: SSO Authentication and User Management

Issue

After implementing SSO, users who previously had native DataHub accounts receive new accounts when logging in via SSO, even when their email addresses match existing accounts. This creates duplicate accounts and causes loss of continuity with the original account, metadata, and permissions.

You Might Be Asking

Can I merge two user accounts in DataHub?
How do I permanently delete a user account?
Why doesn't SSO match users by email address?
How can I prevent duplicate accounts going forward?

Solution

Understanding Why Duplicates Occur

DataHub identifies SSO users using a username claim from the identity provider (such as sub or preferred_username), not by email address. Email is only stored as a profile attribute and is never used for account matching. When an existing native user logs in via SSO, if their SSO username claim differs from their original DataHub username, a new account is created.

Account Merging (Not Available)

DataHub does not support merging user accounts. There is no GraphQL mutation, REST endpoint, or admin tool to combine two separate user accounts or transfer their associated metadata and history.

Deleting User Accounts

Navigate to Settings → Users & Groups in your DataHub instance
Locate the duplicate account you want to remove
Use the removeUser GraphQL mutation (requires Manage Users & Groups privilege)
Note: This is a hard delete that removes the user entity and asynchronously purges all references

Alternative: Deactivate the account instead by setting status to INACTIVE, which prevents login without destroying account data.

Preventing Future Duplicates

Configure the OIDC userNameClaim to match the format used for existing native accounts
If native users were created with email as username, configure:
```
auth:
  oidc:
    userNameClaim: "email"
```
Contact your DataHub support team to update this configuration for your environment
Test with a single user before rolling out to all users

Managing Existing Duplicates

Identify all duplicate accounts (often caused by email casing differences like user@example.com vs User@example.com)
Manually transfer any necessary group memberships or role assignments from the old account to the SSO account
Delete the obsolete native account using the removeUser mutation
Ensure the userNameClaim is properly configured before users log in again

Additional Notes

The duplicate account issue is a known design characteristic rather than a bug. Email-based account matching during SSO login is not currently implemented in DataHub. Case sensitivity in email addresses can also cause duplicates. Always test SSO configuration changes with a small group of users before deploying organization-wide. Account deletion is irreversible and will remove all associated user data and permissions.