Fix OIDC login for manually matched users with mismatching Entra username - #3364
Fix OIDC login for manually matched users with mismatching Entra username#3364Lai Wei (weilai-irl) wants to merge 1 commit into
Conversation
Lai Wei (weilai-irl)
changed the title
There was a problem hiding this comment.
🟡 Changes recommended
The new lowercasing in match lookup can break legacy mixed-case entraidupn rows on case-sensitive DBs, and the new test should ensure global $_GET cleanup via try/finally to prevent cross-test pollution.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.
Pull request overview
This PR fixes an OIDC login edge case where a manually matched user (keyed by Entra UPN) could be found but then effectively ignored when the Moodle username differs from the UPN, causing login failures. It also aims to reduce case-mismatch issues by normalizing entraidupn casing during manual matching and lookup.
Changes:
- Normalize manually entered
entraidupnto lowercase when saving user connections. - During OIDC auth-code login, bind to the matched Moodle user’s actual username (instead of the Microsoft-derived identifier) when the matched user is already
auth='oidc'. - Add a regression PHPUnit test covering the “manual match + differing username” login flow.
File summaries
| File | Description |
|---|---|
| local/o365/classes/page/acp.php | Lowercases manually entered Entra UPN when creating a manual match. |
| auth/oidc/classes/loginflow/authcode.php | Normalizes match lookup input and binds $username to the matched Moodle user’s username when appropriate. |
| auth/oidc/tests/loginflow/authcode_test.php | Adds regression coverage for manually matched users whose Moodle username differs from Entra UPN. |
Review details
- Files reviewed: 3/3 changed files
- Comments generated: 2
- Review effort level: Lite
We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.
…name Manually matched users are keyed by Entra UPN, which often differs from the Moodle username. handlelogin() found the matched user but then discarded it, continuing with the UPN as the username and failing with "User not found in Moodle." Now it binds to the matched user's actual username instead. Also normalizes entraidupn casing on write and read to avoid case-mismatch failures.
0303823 to
fa61a75
Compare
Manually matched users are keyed by Entra UPN, which often differs from the Moodle username. handlelogin() found the matched user but then discarded it, continuing with the UPN as the username and failing with "User not found in Moodle." Now it binds to the matched user's actual username instead. Also normalizes entraidupn casing on write and read to avoid case-mismatch failures.