Scheduled user updates don't run when "Create or Sync to Drupal user on successful authentication" is unticked

Problem/Motivation

We have "Schedule user updates" enabled and pointing to a working LDAP query.

I unticked "Create or Sync to Drupal user on successful authentication with LDAP credentials" because we don't want users to be created or updated at login time, only during the scheduled sync.

I later discovered the scheduled syncs had stopped working correctly - while new users were created, existing users were never updated.

Debug Report

I believe the reasoning is as follows:

• ldap_user_cron() calls GroupUserUpdateProcessor::runQuery().
• That correctly gets the list of users, and for each one calls GroupUserUpdateProcessor::processAccount().
• That creates any new users as expected, but for existing users it calls DrupalUserProcessor::drupalUserLogsIn().
• That checks whether "Create or Sync to Drupal user on successful authentication with LDAP credentials" is ticked before it calls DrupalUserProcessor::syncToDrupalAccount().

As a result, when it is unticked, syncToDrupalAccount() is never called.

Proposed resolution

I don't think $this->drupalUserProcessor->drupalUserLogsIn($drupal_account) should be used in the cron job, as they are not logging in at this point. I would add another function to call instead, for example:

  /**
   * Handle Drupal user scheduled update.
   *
   * @param \Drupal\user\UserInterface $account
   *   The Drupal user.
   */
  public function drupalUserScheduledUpdate(UserInterface $account): void {
    if ($this->excludeUser($this->account)) {
      return;
    }

    $this->account = $account;
    $this->syncToDrupalAccount();
    $this->saveAccount();
  }

Remaining tasks

User interface changes

API changes

Data model changes