asgardeo · DonOmalVindula · Sep 8, 2026 · Sep 8, 2026 · Sep 8, 2026 · Sep 8, 2026
diff --git a/.changeset/readonly-federated-profile.md b/.changeset/readonly-federated-profile.md
@@ -0,0 +1,18 @@
+---
+'@asgardeo/javascript': patch
+'@asgardeo/i18n': patch
+'@asgardeo/react': patch
+'@asgardeo/nextjs': patch
+---
+
+Render a read-only profile for users whose attributes are owned by an identity provider.
+
+Asgardeo rejects attribute updates for accounts provisioned from a social or enterprise connection, so the profile used to offer edit controls that always failed with a raw SCIM error.
+
+- `<UserProfile />` accepts `editable="auto"` in React and Next.js. On Asgardeo it looks up the signed-in user's federated associations and, when the account is linked to a connection, renders the profile read-only with a short note naming the provider. On WSO2 Identity Server, where the same updates succeed, the profile stays editable.
+- `<UserDropdown />` forwards `editable` to the profile it opens from "Manage profile", so the modal follows the same rule as the page.
+- `BaseUserProfile` accepts a predicate for `editable`, so applications can decide per user without any lookup, and a `readOnlyNote` to explain why editing is unavailable.
+- A rejected update is now reported in plain words instead of the raw SCIM error, and switches the profile to read-only for the rest of the session. The Next.js `<UserProfile />` previously ignored update failures entirely.
+- New API `getMeFederatedAssociations` in `@asgardeo/javascript` and `@asgardeo/react`, plus the `signup`-style texts `user.profile.readonly.federated` and `user.profile.update.not.allowed.error` in all i18n bundles.
+
+While `auto` is resolving, the profile shows a loading state rather than edit controls it may have to take away; `BaseUserProfile` now renders that state whenever `isLoading` is set, in both inline and popup modes. In popup mode the lookup is deferred until the profile is actually opened.
diff --git a/packages/i18n/src/models/i18n.ts b/packages/i18n/src/models/i18n.ts
@@ -116,6 +116,9 @@ export interface I18nTranslations {
 
   'user.profile.heading': string;
   'user.profile.update.generic.error': string;
+  'user.profile.loading': string;
+  'user.profile.readonly.federated': string;
+  'user.profile.update.not.allowed.error': string;
 
   /* |---------------------------------------------------------------| */
   /* |                     Organization Switcher                     | */

diff --git a/packages/i18n/src/translations/en-US.ts b/packages/i18n/src/translations/en-US.ts
@@ -118,7 +118,12 @@ const translations: I18nTranslations = {
   /* |---------------------------------------------------------------| */
 
   'user.profile.heading': 'Profile',
+
+  'user.profile.loading': 'Loading profile',
   'user.profile.update.generic.error': 'An error occurred while updating your profile. Please try again.',
+  'user.profile.readonly.federated': 'This profile is managed by your {provider} account and cannot be edited here.',
+  'user.profile.update.not.allowed.error':
+    'Your profile is managed by your identity provider, so these details cannot be changed here.',
 
   /* |---------------------------------------------------------------| */
   /* |                     Organization Switcher                     | */

diff --git a/packages/i18n/src/translations/fr-FR.ts b/packages/i18n/src/translations/fr-FR.ts
@@ -117,6 +117,13 @@ const translations: I18nTranslations = {
   /* |---------------------------------------------------------------| */
 
   'user.profile.heading': 'Profil',
+
+  'user.profile.loading': 'Chargement du profil',
+
+  'user.profile.readonly.federated': 'Ce profil est géré par votre compte {provider} et ne peut pas être modifié ici.',
+
+  'user.profile.update.not.allowed.error':
+    "Votre profil est géré par votre fournisseur d'identité, ces informations ne peuvent donc pas être modifiées ici.",
   'user.profile.update.generic.error':
     'Une erreur est survenue lors de la mise à jour de votre profil. Veuillez réessayer.',
 

diff --git a/packages/i18n/src/translations/hi-IN.ts b/packages/i18n/src/translations/hi-IN.ts
@@ -116,6 +116,14 @@ const translations: I18nTranslations = {
   /* |---------------------------------------------------------------| */
 
   'user.profile.heading': 'प्रोफ़ाइल',
+
+  'user.profile.loading': 'प्रोफ़ाइल लोड हो रही है',
+
+  'user.profile.readonly.federated':
+    'यह प्रोफ़ाइल आपके {provider} खाते द्वारा प्रबंधित है और इसे यहाँ संपादित नहीं किया जा सकता।',
+
+  'user.profile.update.not.allowed.error':
+    'आपकी प्रोफ़ाइल आपके पहचान प्रदाता द्वारा प्रबंधित है, इसलिए ये विवरण यहाँ नहीं बदले जा सकते।',
   'user.profile.update.generic.error': 'प्रोफ़ाइल अपडेट करते समय त्रुटि हुई। कृपया पुनः प्रयास करें।',
 
   /* |---------------------------------------------------------------| */

diff --git a/packages/i18n/src/translations/ja-JP.ts b/packages/i18n/src/translations/ja-JP.ts
@@ -116,6 +116,14 @@ const translations: I18nTranslations = {
   /* |---------------------------------------------------------------| */
 
   'user.profile.heading': 'プロフィール',
+
+  'user.profile.loading': 'プロフィールを読み込んでいます',
+
+  'user.profile.readonly.federated':
+    'このプロフィールは {provider} アカウントで管理されているため、ここでは編集できません。',
+
+  'user.profile.update.not.allowed.error':
+    'プロフィールは ID プロバイダーによって管理されているため、ここでは変更できません。',
   'user.profile.update.generic.error': 'プロフィール更新中にエラーが発生しました。もう一度お試しください。',
 
   /* |---------------------------------------------------------------| */

diff --git a/packages/i18n/src/translations/pt-BR.ts b/packages/i18n/src/translations/pt-BR.ts
@@ -116,6 +116,13 @@ const translations: I18nTranslations = {
   /* |---------------------------------------------------------------| */
 
   'user.profile.heading': 'Perfil',
+
+  'user.profile.loading': 'Carregando perfil',
+
+  'user.profile.readonly.federated': 'Este perfil é gerenciado pela sua conta {provider} e não pode ser editado aqui.',
+
+  'user.profile.update.not.allowed.error':
+    'Seu perfil é gerenciado pelo seu provedor de identidade, portanto esses dados não podem ser alterados aqui.',
   'user.profile.update.generic.error': 'Ocorreu um erro ao atualizar seu perfil. Tente novamente.',
 
   /* |---------------------------------------------------------------| */

diff --git a/packages/i18n/src/translations/pt-PT.ts b/packages/i18n/src/translations/pt-PT.ts
@@ -116,6 +116,13 @@ const translations: I18nTranslations = {
   /* |---------------------------------------------------------------| */
 
   'user.profile.heading': 'Perfil',
+
+  'user.profile.loading': 'A carregar o perfil',
+
+  'user.profile.readonly.federated': 'Este perfil é gerido pela sua conta {provider} e não pode ser editado aqui.',
+
+  'user.profile.update.not.allowed.error':
+    'O seu perfil é gerido pelo seu fornecedor de identidade, pelo que estes dados não podem ser alterados aqui.',
   'user.profile.update.generic.error': 'Ocorreu um erro ao actualizar o seu perfil. Tente novamente.',
 
   /* |---------------------------------------------------------------| */

diff --git a/packages/i18n/src/translations/si-LK.ts b/packages/i18n/src/translations/si-LK.ts
@@ -116,6 +116,14 @@ const translations: I18nTranslations = {
   /* |---------------------------------------------------------------| */
 
   'user.profile.heading': 'පැතිකඩ',
+
+  'user.profile.loading': 'පැතිකඩ පූරණය වෙමින්',
+
+  'user.profile.readonly.federated':
+    'මෙම පැතිකඩ ඔබගේ {provider} ගිණුම මගින් කළමනාකරණය වන අතර මෙහිදී සංස්කරණය කළ නොහැක.',
+
+  'user.profile.update.not.allowed.error':
+    'ඔබගේ පැතිකඩ ඔබගේ අනන්‍යතා සපයන්නා විසින් කළමනාකරණය කරන බැවින්, මෙම විස්තර මෙහිදී වෙනස් කළ නොහැක.',
   'user.profile.update.generic.error': 'ඔබේ පැතිකඩ යාවත්කාලීන කිරීමේදී දෝෂයක් ඇතිවිය.කරුණාකර නැවත උත්සාහ කරන්න',
 
   /* |---------------------------------------------------------------| */

diff --git a/packages/i18n/src/translations/ta-IN.ts b/packages/i18n/src/translations/ta-IN.ts
@@ -116,6 +116,14 @@ const translations: I18nTranslations = {
   /* |---------------------------------------------------------------| */
 
   'user.profile.heading': 'சுயவிவரம்',
+
+  'user.profile.loading': 'சுயவிவரம் ஏற்றப்படுகிறது',
+
+  'user.profile.readonly.federated':
+    'இந்தச் சுயவிவரம் உங்கள் {provider} கணக்கால் நிர்வகிக்கப்படுகிறது, இங்கே திருத்த முடியாது.',
+
+  'user.profile.update.not.allowed.error':
+    'உங்கள் சுயவிவரம் அடையாள வழங்குநரால் நிர்வகிக்கப்படுகிறது, எனவே இந்த விவரங்களை இங்கே மாற்ற முடியாது.',
   'user.profile.update.generic.error':
     'உங்கள் சுயவிவரத்தை புதுப்பிக்கும் போது பிழை ஏற்பட்டது. மீண்டும் முயற்சிக்கவும்.',
 

diff --git a/packages/i18n/src/translations/te-IN.ts b/packages/i18n/src/translations/te-IN.ts
@@ -117,6 +117,13 @@ const translations: I18nTranslations = {
   /* |---------------------------------------------------------------| */
 
   'user.profile.heading': 'ప్రొఫైల్',
+
+  'user.profile.loading': 'ప్రొఫైల్ లోడ్ అవుతోంది',
+
+  'user.profile.readonly.federated': 'ఈ ప్రొఫైల్ మీ {provider} ఖాతా ద్వారా నిర్వహించబడుతుంది, ఇక్కడ సవరించలేరు.',
+
+  'user.profile.update.not.allowed.error':
+    'మీ ప్రొఫైల్ మీ ఐడెంటిటీ ప్రొవైడర్ ద్వారా నిర్వహించబడుతుంది, కాబట్టి ఈ వివరాలను ఇక్కడ మార్చలేరు.',
   'user.profile.update.generic.error': 'ప్రొఫైల్ అప్‌డేట్ చేస్తూ లోపం వచ్చింది. దయచేసి మళ్లీ ప్రయత్నించండి.',
 
   /* |---------------------------------------------------------------| */

diff --git a/packages/javascript/src/api/getMeFederatedAssociations.ts b/packages/javascript/src/api/getMeFederatedAssociations.ts
@@ -0,0 +1,102 @@
+/**
+ * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import AsgardeoAPIError from '../errors/AsgardeoAPIError';
+import {FederatedAssociation} from '../models/federated-association';
+
+/**
+ * Configuration for the `getMeFederatedAssociations` request.
+ */
+export interface GetMeFederatedAssociationsConfig extends Omit<RequestInit, 'method'> {
+  /**
+   * The base path of the API endpoint.
+   */
+  baseUrl?: string;
+  /**
+   * Optional custom fetcher function. If not provided, native fetch will be used.
+   */
+  fetcher?: (url: string, config: RequestInit) => Promise<Response>;
+  /**
+   * The absolute API endpoint.
+   */
+  url?: string;
+}
+
+/**
+ * Retrieves the identity provider accounts linked to the signed-in user.
+ *
+ * An account provisioned just-in-time from a social or enterprise connection has at least one
+ * association; a user who registered locally has none.
+ *
+ * @param config - Request configuration.
+ * @returns The list of associations, empty when the account is purely local.
+ * @example
+ * ```ts
+ * const associations = await getMeFederatedAssociations({baseUrl: 'https://api.asgardeo.io/t/<org>'});
+ * const isFederated = associations.length > 0;
+ * ```
+ */
+const getMeFederatedAssociations = async ({
+  url,
+  baseUrl,
+  fetcher,
+  ...requestConfig
+}: GetMeFederatedAssociationsConfig): Promise<FederatedAssociation[]> => {
+  try {
+    // eslint-disable-next-line no-new
+    new URL(url ?? baseUrl);
+  } catch (error) {
+    throw new AsgardeoAPIError(
+      `Invalid URL provided. ${error?.toString()}`,
+      'getMeFederatedAssociations-ValidationError-001',
+      'javascript',
+      400,
+      'The provided `url` or `baseUrl` path does not adhere to the URL schema.',
+    );
+  }
+
+  const fetchFn: typeof fetch = fetcher || fetch;
+  const resolvedUrl: string = url ?? `${baseUrl}/api/users/v1/me/federated-associations`;
+
+  const response: Response = await fetchFn(resolvedUrl, {
+    ...requestConfig,
+    headers: {
+      Accept: 'application/json',
+      ...requestConfig.headers,
+    },
+    method: 'GET',
+  });
+
+  if (!response?.ok) {
+    const errorText: string = await response.text();
+
+    throw new AsgardeoAPIError(
+      errorText,
+      'getMeFederatedAssociations-ResponseError-001',
+      'javascript',
+      response.status,
+      response.statusText,
+    );
+  }
+
+  const associations: unknown = await response.json();
+
+  return Array.isArray(associations) ? (associations as FederatedAssociation[]) : [];
+};
+
+export default getMeFederatedAssociations;
diff --git a/packages/javascript/src/index.ts b/packages/javascript/src/index.ts
@@ -34,6 +34,9 @@ export {default as executeEmbeddedSignUpFlow} from './api/executeEmbeddedSignUpF
 export {default as getUserInfo} from './api/getUserInfo';
 export {default as getScim2Me} from './api/getScim2Me';
 export type {GetScim2MeConfig} from './api/getScim2Me';
+export {default as getMeFederatedAssociations} from './api/getMeFederatedAssociations';
+export type {GetMeFederatedAssociationsConfig} from './api/getMeFederatedAssociations';
+export type {FederatedAssociation} from './models/federated-association';
 export {default as getSchemas} from './api/getSchemas';
 export type {GetSchemasConfig} from './api/getSchemas';
 export {default as getAllOrganizations} from './api/getAllOrganizations';

diff --git a/packages/javascript/src/models/federated-association.ts b/packages/javascript/src/models/federated-association.ts
@@ -0,0 +1,41 @@
+/**
+ * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * A link between the local user account and an identity in an external identity provider,
+ * created when the user is provisioned just-in-time or when the account is linked.
+ */
+export interface FederatedAssociation {
+  /**
+   * The user's identifier at the identity provider.
+   */
+  federatedUserId?: string;
+  /**
+   * Unique identifier of the association.
+   */
+  id?: string;
+  /**
+   * The identity provider the account is linked to.
+   */
+  idp?: {
+    displayName?: string;
+    id?: string;
+    imageUrl?: string;
+    name?: string;
+  };
+}
diff --git a/packages/nextjs/src/client/components/presentation/UserDropdown/UserDropdown.tsx b/packages/nextjs/src/client/components/presentation/UserDropdown/UserDropdown.tsx
@@ -21,7 +21,7 @@
 import {BaseUserDropdown, BaseUserDropdownProps} from '@asgardeo/react';
 import {FC, ReactElement, ReactNode, useState} from 'react';
 import useAsgardeo from '../../../contexts/Asgardeo/useAsgardeo';
-import UserProfile from '../UserProfile/UserProfile.js';
+import UserProfile, {UserProfileProps} from '../UserProfile/UserProfile.js';
 
 /**
  * Render props data passed to the children function
@@ -51,6 +51,12 @@ export type UserDropdownProps = Omit<BaseUserDropdownProps, 'user' | 'onManagePr
    * When provided, this completely replaces the default dropdown rendering.
    */
   children?: (props: UserDropdownRenderProps) => ReactNode;
+  /**
+   * Whether the profile shown by the "Manage profile" item can be edited. Forwarded to
+   * `<UserProfile />`, so `'auto'` renders a read-only profile for accounts whose attributes
+   * are owned by an identity provider.
+   */
+  editable?: UserProfileProps['editable'];
   /**
    * Custom render function for the dropdown content.
    * When provided, this replaces just the dropdown content while keeping the trigger.
@@ -114,6 +120,7 @@ const UserDropdown: FC<UserDropdownProps> = ({
   renderTrigger,
   renderDropdown,
   onSignOut,
+  editable,
   ...rest
 }: UserDropdownProps): ReactElement => {
   const {user, isLoading, signOut} = useAsgardeo();
@@ -149,7 +156,7 @@ const UserDropdown: FC<UserDropdownProps> = ({
     return (
       <>
         {children(renderProps)}
-        <UserProfile mode="popup" open={isProfileOpen} onOpenChange={setIsProfileOpen} />
+        <UserProfile mode="popup" editable={editable} open={isProfileOpen} onOpenChange={setIsProfileOpen} />
       </>
     );
   }
@@ -172,7 +179,7 @@ const UserDropdown: FC<UserDropdownProps> = ({
           />
         )}
         {/* Note: renderDropdown would need BaseUserDropdown modifications to implement properly */}
-        <UserProfile mode="popup" open={isProfileOpen} onOpenChange={setIsProfileOpen} />
+        <UserProfile mode="popup" editable={editable} open={isProfileOpen} onOpenChange={setIsProfileOpen} />
       </>
     );
   }
@@ -187,7 +194,9 @@ const UserDropdown: FC<UserDropdownProps> = ({
         onSignOut={handleSignOut}
         {...rest}
       />
-      {isProfileOpen && <UserProfile mode="popup" open={isProfileOpen} onOpenChange={setIsProfileOpen} />}
+      {isProfileOpen && (
+        <UserProfile mode="popup" editable={editable} open={isProfileOpen} onOpenChange={setIsProfileOpen} />
+      )}
     </>
   );
 };