Automatically associate existing users with CAS users

https://drupal.org/node/1261232

If we had the option in the past to automatically link users to existing Drupal accounts on login, I have no idea why that was removed. That was before my time, but to me, that makes sense. As I said in the other issue, it does seem like an edge case, but I agree there should be some way to do this.

This could be split into two features:
1) Convert the admin page to adding CAS users to a bulk operation form, so many can be added at once. This satisfies the use case where you don't want to create new accounts on first time CAS login, but do want to mass import a bunch of accounts.

2) Add an option to automatically link an existing Drupal user account with a CAS user if the Drupal account doesn't already have an association.

alberghini, would you agree this applies to #2?

Also for what it's worth, @vinmassaro mentioned in IRC that they already have a submodule developed for #1 and he is working on creating a patch to bring it into the main module.

I would generally support feeds integration here over user_import. It has a broader install base and has drupal 8 dev releases already. I'd love to see a patch rolled for this.

I have the history about the old "Hijack users" setting if anyone cares, but I think importing bulk is a cleaner interface.

Will try to follow up soon with a patch for the bulk CAS user creation mentioned in #4.

Patch added for bulk user creation. Need help with tests: https://drupal.org/node/2238973

Failing tests fixed: https://drupal.org/node/2238973

I work at a University and also need this option desperately. Currently we have CAS working but many of our users were already created and have user data associated with them.

I also checked the code mentioned in the CAS documentation and for some reason could not get it to work.

So my vote would be a setting somewhere in the "user" settings that asks if a user already exists use the "CAS' login feature.

Thank you much.

The old code base had a setting called "Hijack existing user accounts" which created the cas entry based on the username. It was eliminated during the 6 to 7 conversion effort. There were some odd cases where it was causing some duplicate users being created for a user when accounts were renamed. That is why it got removed. If the use case here is primarily a conversion one, I'd reccomend creating a "migrate existing user accounts" to facilitate the one time bulk creation of user accounts, rather than doing this check at every login? Does that make sense to the folks who are requesting this?

So are you saying use feeds or some other migrate user accounts module to re-import users ?

Actually I was suggesting we develop a feature that could be run that would use a single SQL statement to create the initial entries, to fill the use case where we are trying to help people implement cas on sites that have a large pre-existing account base.

There are two possible separate use cases.

1.) People want to set up a new drupal site that restricts access to a list of users of users from an external source. They want to regularly update that list of users from a .csv file (or other source). For this I suggest building a feeds plugin that allows users to cas mappings from feeds.

2.) People are installing cas and want to convert an existing large user base to a cas authenticated one. There's no need for an external source of cas user names because they are already in the database. This could be embedded in a collapsible fieldset on the bulk create page.

I was trying to figure out whether you needed 1 or 2 here. They seem like slightly different use cases.

Dave

I've written some custom code in the past to solve use case 2, and it involves updating the authmap table to set existing users to cas, and then populating the cas_user table with the cas usernames for existing users. That use case should be fairly easy to accommodate.

The authmap table has been deprecated. We were told this in an issue we filed with the core developers, which is why we created the cas_user table to begin with. Openid was supposed to move this way as well. There may still be authmap entries in your database, but I wouldn't recommend populating them when acomodating this feature.

Right, but you would probably want to do something with them when migrating away from your previous authentication mechanism if they existed. I suppose you might as well delete them instead.

@metzlerd,

My request is for number #2. I have 2000 users that I need to be given a CAS username / role.

It seems to me that if Feeds could recognize the CAS username field and be able to update the user profile with the CAS username then it would solve both issues you mention.

In the current Dev version of the module you added a feature where I can bulk create users by pasting the usernames in a text box but unfortunately it doesn't update current users and gives an error stating that the user is already created.

I think if both features where implemented it would be HUGE improvement from a usability standpoint.

Thanks
Kaleem

The link provided in comment #1 https://drupal.org/node/1261232 Doesn't work and I receive the following error after creating a custom module with the code provided.

Warning: array_flip(): Can only flip STRING and INTEGER values! in DrupalDefaultEntityController->load() (line 178 of /srv/bindings/275d77266e1f471eb2b9f9f92b2b0e1a/code/includes/entity.inc).

A new account could not be created for kclarks2. The username is already in use on this site.

Any other suggestions as to how I can give existing users a CAS username ?

Thanks,

have been seeing a lot of work going into the module and wanted to make sure this is being addressed.

The two workarounds listed here both modify local user accounts (that I'd rather not touch) as well as those potentially created through another auth system. This isn't ideal, and an option to associate a CAS user with an existing user seems essential to me.

In Columbia University's case, we are switching from WIND auth to CAS.

Is anyone working on this feature? If not, I will start working on a patch.

I think that it is safe to say that no one is working on thighs ATM. I would welcome a patch here, especially if it worked with feeds module.

I wanted to update this ticket to mention that the SQL query here that adds entries to the cas_user table: https://www.drupal.org/node/1261232 turned out to be fine for my situation, so I'm not working on a patch for this.

This was requested in the D8 version recently as well #3038027: Provide a form for bulk-associating existing Drupal accounts with CAS

I'm not comfortable doing this for D7 as proposed. There are security implications to this that may be overlooked. It assumes that all usernames on your site match exactly with the CAS usernames, which may not be the case.

In D8, we're going to add a form that has a button to do this as a one-time process. And will provide wording about the security issues of doing so.

I'm upgrading a site that uses a Drupal's user data as a source for an otherwise independent CAS server. The CAS server queries data from Drupal, and then other sites, including the one with user data, can log in via CAS. It's an old hack, but CAS user names match up exactly with user accounts on the Drupal site.

I know this is a niche use case, but I believe that this issue is relevant to this topic. I followed the linked documentation for allowing new users to log in via CAS, and ran into an issue I hope to get help with.

When creating an account, the CAS user name does not get set, and "Allow user to log in via CAS" is not selected on their profile. There seems to be no documentation or string matches for "operations_create_username" nor "create_username" in the cas or externalauth modules, so it's hard to find the correct way of doing this.

I suspect that this bug occurs because user is not being added to the 'authmap' table which stores externalauth account associations.

I also tried modifying the provided code with something similar, based on a test case I found in the cas module:

function auto_cas_user_cas_user_alter(&$cas_user) {
  $cas_name = $cas_user['name'];

  if (cas_user_load_by_name($cas_name) === FALSE) {
    // No existing user could be found by CAS username.

    $account = \Drupal::entityTypeManager()->getStorage('user')->load(array('name' => $cas_name));
    if ($account && $account->uid) {
      // We found an existing user with the same username, add a CAS username.
      //cas_user_operations_create_username(array($account->uid));
      ///////// based on code from test case:
      \Drupal::service('externalauth.authmap')->save($account, 'cas', $cas_name);
    }
  }
}

but I'm still getting no result. I wonder if the code is being run at all? It's in a Drupal 11 compatible module that is marked as installed by Drupal.

I still have a lot to learn about Drupal module development, but if anyone has any ideas for a possible patch to the documentation, that would be much appreciated.

I finally got this working. Here's how to link newly created accounts to CAS on Drupal 11 if your module is called auto_cas_user:

use Drupal\Core\Entity\EntityInterface;

function auto_cas_user_entity_insert(EntityInterface $entity) : void {
  if (get_class($entity) === 'Drupal\user\Entity\User') {
    \Drupal::service('externalauth.authmap')->save($entity, 'cas', $entity->getAccountName());
  }
}