It would be great if this could be tackled. MediaWiki 1.39.6 was released recently, and I am stuck with 1.39.2. I think it was unwise to change this extension for an LTE release mid-lifecycle.

I have tried to install a current version of MediaWiki with working versions of PluggableAuth and SimpleSAMLphp using composer, but the latter extension seems not to be available to composer.

I can confirm this issue and have provided a patch: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/SimpleSAMLphp/+/991744

@CCicalese_WMF The issue is, that when a new user gets created, the PluggableAuthPlugin gets re-instantiated (apparently the request context changes in this case) and the new instance does not know about the SAML attributes from the initial authentication anymore. Extension:OpenIDConnect hat the same issue, but has already a workaround implemented: It stores the "payload" data from the OICD response in the session and uses this in PluggableAuthPlugin::getAttributes rather than a some object variable. I have now implemented the same workaround in Extension:SimpleSAMLphp, but I believe this should better be fixed in Extension:PluggableAuth, as it may affect other plugins as well. In my opinion, Extension:PluggableAuth should store the value of PluggableAuthPlugin::getAttributes in the session data, right after PluggableAuth::authenticate was called and then use this session data in GroupProcessRunner::run. Do you agree? If so I can provide a patch to Extension:PluggableAuth (and patches to Extension:OpenIDConnect and Extension:SimpleSAMLphp that remove the workaround).

Great catch! I agree completely with the proposed solution. Yes, please provide patches to move that functionality to PluggableAuth. Thank you!

I can confirm that this fixes the problem for me as well. Many thanks again!!