Remove access check from UserAuthentication:lookupAccount query [#3525394]

I'm unable to log in to a site with email OR username login enabled when user entities are not visible to anonymous users.

This is because the Drupal\email_registration\UserAuthentication::lookupAccount method uses an entity query to do the user lookup, and this query has access checking enabled.

Let's disable that access check as this query needs to return a user before we have a logged in user.

Issue fork email_registration-3525394

Show commands

Start within a Git clone of the project using the version control instructions.

Add & fetch this issue fork’s repository

Or, if you do not have SSH keys set up on git.drupalcode.org:

Add & fetch this issue fork’s repository

3525394-remove-access-check changes, plain diff MR !59
Check out this branch for the first time

Check out existing branch, if you already have it locally

About issue forks

Comments

Comment #1

20 May 2025 at 02:27

thtas created an issue. See original summary.

Comment #2

thtas commented 20 May 2025 at 02:28

Title:

Remove access check from UserAuth:lookupAccount query

» Remove access check from UserAuthentication:lookupAccount query

Comment #3

20 May 2025 at 02:29

thtas opened merge request !59

Comment #4

thtas commented 20 May 2025 at 02:32

Status:

Active

» Needs review

Comment #5

estebanvalerio.h commented 26 August 2025 at 17:13

@thtas I'm not able to reproduce the issue with module version 2.x-dev.
After installing it, I was able to log in with username or email.
I check the code update at https://git.drupalcode.org/project/email_registration/-/merge_requests/5... and compare it with the code on my environment, the accessCheck is set to TRUE and this wasn't a blocker to log in
Can you specify which steps to follow to reproduce the issue? Thanks

Comment #6

thtas commented 4 September 2025 at 01:25

The issue arises when some modules need to have a say on the query access for user entities.

e.g. in my scenario, I have a site which uses the groups module which will implement query level access and is configured in such a way that users are not visible to anonymous users.

This could also happen if you used the "entity" module and implemented a query access handler for user entities.

Also, the parent call from the core class that this class extends from will also skip access checking as it uses the entity storage loadByProperties method.