Hello,

We use account names to authenticate our clients, that don't have a server name, and after updating to the latest drupal version, none of our account name users have been able to log in.

I've done some digging and noticed that if the account doesn't have an entry in the authmap database and authenticates from an external source, the only path the code takes now is to try and create the user.

I do believe in past versions, it would return the user object in other situations, and is functionality we depend on. I've patched the behavior back in locally, by adding:

} else {
  $user = $registered_user;
}

to line 1028 in user.module.

Comments

damien tournoud’s picture

Status: Active » Closed (won't fix)

We changed that a few months ago (how long have you withhold upgrading?), for security reasons. Trusting remote authentication for users that are not in the authmap was a bug with nasty security consequences.