Account changes in pre-authorize are not linked via ExternalAuth

Created on 10 August 2022, over 2 years ago
Updated 26 September 2023, over 1 year ago

Problem/Motivation

Account changes in hook_openid_connect_pre_authorize are not linked to the user via External Authentication (externalauth)'s linkExistingAccount / authmap table. This also has ramifications on the logout, because if the user is not linked via externalauth the logout functionality does not fire - i.e. the user will not be logged out of their IdP even if you specify that they should.

Steps to reproduce

  1. Install and configure this module and a client to use that supports logout; configure it to perform the IdP logout on logout
  2. Create a Drupal account that you will connect to using the client
  3. Implement hook_openid_connect_pre_authorize and use some identifying info in the context to determine when to return the account you created; for simplicity, you could duplicate the email matching logic in OpenIDConnect->completeAuthorization to choose a user (obviously this isn't a real use case, but it will demonstrate the problem that occurs if you are customizing how the user is connected)
  4. Log in as the user via the client
  5. Go to the /user/{user}/connected-accounts page, note that the connection is not listed
  6. Check the ExternalAuth module's authmap table; note that the user mapping is not there
  7. Log out; note that you were not logged out of your provider (this will be evident if you go to sign in again)

Proposed resolution

In OpenIDConnect->completeAuthorization, if the $account is a UserInterface, link the account before saving the user info.

Remaining tasks

User interface changes

API changes

Data model changes

πŸ› Bug report
Status

Active

Version

2.0

Component

Code

Created by

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.71.5 2024