Tenant Rename Creates Duplicate Tenants and Deleted Tenants Reappear

Problem

When renaming a tenant in Private Cloud Director, a new tenant is created with the new name while the original tenant remains intact, resulting in two duplicate tenant entries. Additionally, when the duplicate or stale tenants are manually deleted, they reappear approximately one hour later.

Environment

• Private Cloud Director Virtualization — versions prior to v2026.1.-427
• Self-Hosted Private Cloud Director Virtualization — versions prior to v2026.1.-427
• Component: SSO, Identity Service
• Prerequisite: Enterprise SSO (Microsoft Entra ID or other SAML provider) configured with group role mappings that include project (tenant) names

Cause

SAML group role mappings in Private Cloud Director previously supported specifying project (tenant) names directly within the mapping configuration. When an SSO user belonging to a mapped group logged in, the Identity Service processed the mapping and recreated any listed project that was not currently present — including projects that had been renamed or deleted. This caused two symptoms:

• Tenant rename appears as a new tenant creation. The Identity Service detected the original project name as missing after a rename and recreated it alongside the renamed tenant, leaving both entries present.
• Deleted tenants reappear after approximately one hour. The Identity Service recreated deleted tenants on the next SSO user login.

The project-level access entries in the mapping also caused role assignments to be applied at both the SSO group level and the individual user level simultaneously. This made the user-level assignments persist as static entries, causing access to survive SSO group membership changes.

This behavior is tracked under PCD-5778 and has been resolved in the January 2026 Patch 2 Release. After upgrading and re-saving the SSO configuration, project-level entries are removed from group role mappings automatically.

Diagnostics

Use the following steps to confirm the environment is affected by this specific issue before applying the workaround.

1

Confirm the SSO group mapping contains project names

Navigate to Settings > Authentication and open the SSO configuration. Inspect the group role mapping entries.

If any mapping entry contains a projects array listing specific tenant names, the environment matches this issue.

Example SSO Group Mapping with Project Names (affected configuration)

{
  "local": [
    {
      "group": { "id": "<GROUP_ID>" },
      "projects": [
        { "name": "<TENANT_NAME>", "roles": [{ "name": "admin" }] }
      ]
    }
  ],
  "remote": [...]
}

2

Confirm duplicate tenants are present in the UI

Navigate to Settings > Tenants in the PCD UI. Check whether both the original tenant name and the renamed tenant name appear as separate entries.

Confirmation of the issue shows two distinct tenant entries with the same intended purpose but different UUIDs.

If both checks above match, proceed to Resolution or Workaround.

Resolution

Upgrade to v2026.1.-427 (January 2026 Patch 2 Release) or later. After upgrading, navigate to Settings > Authentication, open the SSO configuration, and re-save without making changes. Re-saving triggers the removal of project-level entries from the group role mappings automatically.

Follow the Workaround steps to clean up any duplicate tenants that were created before the upgrade.

Workaround

Apply the following steps for environments not yet upgraded to v2026.1.2, or to clean up duplicate tenants that already exist.

Only SSO-derived role assignments are recreated automatically on the next user login. Local or manually-created role assignments are not automatically recreated after deletion. Document any manually-managed role assignments before proceeding.

1

Remove affected tenant names from the SSO group mapping

Navigate to Settings > Authentication in the PCD UI and open the SSO group role mapping configuration.

Remove all projects entries from each group mapping. Do not remove the group-to-role mapping entries themselves — only remove the projects array and its contents from the mapping structure.

Save the SSO configuration after making the changes.

2

Delete the duplicate or stale tenants

Navigate to Settings > Tenants and delete the duplicate or stale tenants.

Deleting a tenant automatically removes all role assignments associated with that tenant. Pre-removing role assignments individually before deletion is not required.

If both the original tenant and the duplicate both need to be removed, delete both. Role assignments for both tenants are removed automatically as part of deletion.

If only the stale duplicate needs to be removed, delete the unwanted tenant and retain the one with the correct name and resources.

3

Verify deleted tenants do not reappear

Wait approximately 60–90 minutes — enough time for at least one SSO login cycle to complete — then navigate to Settings > Tenants and confirm the deleted tenants are absent.

The deleted tenants should no longer appear in the tenant list. If tenants reappear, confirm the SSO configuration was saved successfully in Step 1 and that no projects entries remain in any group mapping.

4

Confirm SSO user access on retained tenants

Have SSO users log out and log back in to the PCD environment. SSO-derived role assignments on retained tenants are recreated automatically at login based on the group-level mapping.

Only role assignments derived from SSO group mappings are recreated automatically on login. Local or manually-created role assignments that were removed must be reassigned manually.

Additional Information

The root cause and fix are tracked under PCD-5778, included in the January 2026 Patch 2 Release (released April 3, 2026).

For guidance on configuring Microsoft Entra ID SSO with Private Cloud Director, see Setup Microsoft Entra ID for PCD in the Platform9 documentation.