Contrib.social

Drupal\ldap_user\Processor\DrupalUserProcessor::createDrupalUser() uses Drupal account name instead of authName value in the authmap table

Open on Drupal.org →
Created on 11 July 2023, 12 months ago
Updated 21 November 2023, 7 months ago

Problem/Motivation

Drupal\ldap_user\Processor\DrupalUserProcessor::createDrupalUser() function stores Drupal account name as authName in authmap table. When new users are created in Drupal, the Drupal account name is derived from the value of the accountName attribute. This is fine when the authName and accountName share the same attribute, e.g. for AD usually it's sAMAccountName. However, when the accountName attribute is different than the authName attribute, the login function breaks.

Steps to reproduce

  1. Configure a LDAP server, and set different attributes for authentication name and account name. E.g. we use userPrincipalName for authName attribute and sAMAccountName for accountName attribute.
  2. Create / use existing user object in the LDAP server. Make sure that the values for authName and accountName are different in the LDAP server. E.g. we use johndoe for accountName and johndoe@realm for authName.
  3. Configure the authentication to exclusive mode and user provisioning settings to sync user from LDAP to Drupal.
  4. Make sure that the user does not exist in Drupal.
  5. Log in as the user in Drupal. User should be created successfully. Observe the authmap table. You should observe abc in the authname column.
  6. Log out, and try to log in again. You should encounter the error here.
  7. Update the authmap table manually, change authname to abc@realm.
  8. Try logging in as the same user again. This should be successful.

Proposed resolution

Store the authName value obtained from LDAP server (instead of Drupal account name) in the authmap table when creating a new Drupal user.

Remaining tasks

Review the submitted patch and merge to main.

User interface changes

None.

API changes

None.

Data model changes

The authname column in authmap table is changed from Drupal account name to LDAP authname.

  • This should be fine for sites which use the same accountName attribute as the authName attribute.
  • For sites which use different attributes, the only way those sites managed to get it to work in the first place is that the value of the authName attribute is the same as the value of the accountName attribute, and therefore there is no issue updating the code without updating the database value.

Conclusion: no hook_update_N is necessary.

Release notes snippet

Fix Drupal\ldap_user\Processor\DrupalUserProcessor::createDrupalUser() to store authName in the authmap table.

🐛 Bug report
Status

Needs work

Version

4.0

Component

Code

Created by

🇸🇬Singapore Lee Jun Long

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

contrib.social Blog FAQ Discussions
Production build 0.69.0 2024