Currently you cannot login if an account with the same username exists within Drupal, but not yet in External Auth. There should be an option to check for this case and use External Auth's linkExistingAccount() function to allow the process to continue

Comments

b_sharpe created an issue. See original summary.

bkosborne’s picture

bkosborne
Primary language English
Location New Jersey, USA
commented

I guess I'm not opposed to adding this as an option, but it just feels pretty dangerous. If you have a local account called "admin" which is user 1, and then your CAS server has some user with "admin" as an ID, then they can login and suddenly become a super admin on your site.

b_sharpe’s picture

b_sharpe commented

I agree, though if a username form SSO is 'admin' that person likely is an admin. I think two options could mitigate this risk:

  • Prevent User 1 - I don't think there's ever a use-case for this, nor should be
  • Allow overriding or keeping existing roles - There's already a role-select for new users, just have an option that sets these exclusively, rather than appending to existing.

If no objections, patch incoming later today likely.

cjokinen’s picture

cjokinen commented

I did a backfill using this query

INSERT INTO authmap (`provider`, `data`, `uid`, `authname`) SELECT 'cas', 'N;', `uid`, `name` FROM users_field_data WHERE uid > 1 AND (SELECT uid FROM authmap WHERE uid = users_field_data.uid) IS NULL;
bkosborne’s picture

bkosborne
Primary language English
Location New Jersey, USA
commented
Status: Active » Postponed (maintainer needs more info)

b_sharpe, can you provide a real world use case where this would be useful? In my experience, it seems most people come across this when they switch authentication systems from local drupal to CAS, and they need a way to mass-associate the existing Drupal accounts with CAS accounts. If that's your use case as well, I think we'd be better off developing a drush command that this module provides to perform a one-time association, just like the commented in #4 wrote.

bkosborne’s picture

bkosborne
Primary language English
Location New Jersey, USA
commented
Title: Allow existing Drupal users to be linked » Provide a form for bulk-associating exisitng Drupal accounts with CAS
Category: Bug report » Feature request
Status: Postponed (maintainer needs more info) » Active

Re-opening this as a feature request to add this option as a one-time process to perform this "backfill".

bkosborne’s picture

bkosborne
Primary language English
Location New Jersey, USA
commented
Title: Provide a form for bulk-associating exisitng Drupal accounts with CAS » Provide a form for bulk-associating existing Drupal accounts with CAS
jordan.jamous’s picture

jordan.jamous commented

Hi bkosborne, I have a real world use case. I am migrating a sub system from D7 to D9. In my case, I got heap lot of existing users where they've got accounts on the CAS server and the new D9 CAS client, the sub-system wasn't using CAS, so I got to find a way to associate existing Drupal accounts with CAS.

#4 sounds reasonable, thanks.

claudiu.cristea’s picture

claudiu.cristea
Primary language Romanian
Location Arad 🇷🇴
commented
Version: 8.x-1.x-dev » 2.x-dev

New features/fixes should go in 2.x.

shakilahmad’s picture

shakilahmad
Shakil
Primary language Urdu
Location Peshawar
commented

I updated the 100k+ users with the role CAS in minutes using this query. it's the same as #4 but here I have put a condition to update only the user having CAS role.

INSERT INTO authmap(`provider`, `data`, `uid`, `authname`) SELECT 'cas', 'N;', ufd.uid, ufd.name FROM `users_field_data` ufd JOIN user__roles ur ON (ur.entity_id = ufd.uid) WHERE ur.roles_target_id = 'cas';