SSO Integration for SonarQube/Jenkins Breaks when Changing the Callback URL

SSO integration for SonarQube/Jenkins breaks when changing callback URL from the Auth0 UI. When trying to log in, the following error is received:

``` invalid_request: No attribute was found to generate the nameIdentifier. We tried with: ```

Steps to Reproduce

1. Install and configure the SonarQube/Jenkins SSO integration.
2. Test the login flow, it should work.
3. In the Auth0 Dashboard UI, change the Callback URL.
4. Test the login flow again. It will end in the above error because nameIdentifierProbes and some of the other options in the SAML add-on are overridden.
5. When checking the addon settings in Inspector, those changes should be seen.

• SSO integration
• Callback URL

Delete the SSO integration, and upon reinstalling, it works as expected as long as changes are not made.

A fix can be applied. Update the SSO integration using the Auth0 Management API (PATCH /api/v2/clients/{id}) to fix it. These are the steps needed to follow:

• Use the Management API endpoint mentioned in Update a client.
• Get the Client ID for this SSO integration in the Auth0 Dashboard > Applications > SSO Integrations > SonarQube > See the Client ID on top, below the name.
• Use the following body in the PATCH request to fix the implementation:

{
    "addons": {
        "samlp": {
            "issuer": "urn:<tenant-name>",
            "mappings": {
                "name": "name",
                "email": "email"
            },
            "createUpnClaim": true,
            "passthroughClaimsWithNoMapping": true,
            "mapUnknownClaimsAsIs": false,
            "mapIdentities": true,
            "signatureAlgorithm": "rsa-sha1",
            "digestAlgorithm": "sha1",
            "lifetimeInSeconds": 3600,
            "signResponse": false,
            "typedAttributes": true,
            "includeAttributeNameFormat": true,
            "nameIdentifierFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified",
            "nameIdentifierProbes": [
                "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier",
                "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",
                "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
            ],
            "authnContextClassRef": "urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified",
            "logout": {
                "slo_enabled": true
            },
            "binding": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
        }
    }
}

Replace <tenant-name> with the name of the Auth0 tenant.
Please note that it breaks again if any changes are made through the Auth0 Dashboard.
Also, the above settings are valid for the SonarQube SSO integration. For Jenkins, try creating a new integration, and retrieve the settings from the new SSO integration, then use that to PATCH the broken one.