Fix OIDC login for manually matched users with mismatching Entra username

[Lai Wei (weilai-irl)]

Manually matched users are keyed by Entra UPN, which often differs from the Moodle username. handlelogin() found the matched user but then discarded it, continuing with the UPN as the username and failing with "User not found in Moodle." Now it binds to the matched user's actual username instead. Also normalizes entraidupn casing on write and read to avoid case-mismatch failures.

[Copilot]

Pull request overview

Fixes OIDC auth-code login when a user has been manually matched via local_o365_connections using their Entra UPN but their Moodle username differs (e.g., UPN vs UPN prefix), and adds casing normalization to reduce case-mismatch failures.

Changes:

• Normalize manually-entered Entra UPN to lowercase during “Manual match” in the O365 ACP UI.
• In OIDC auth-code login, when a manual match exists and the matched Moodle user is already auth=oidc, bind the login to the matched Moodle username (not the Microsoft-derived username).
• Add a PHPUnit regression test covering the manually-matched differing-username login path.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
local/o365/classes/page/acp.php	Lowercases manually entered Entra UPN during manual match flow.
auth/oidc/classes/loginflow/authcode.php	Ensures matched OIDC user login binds to the Moodle username; lowercases Entra UPN input when checking for manual matches.
auth/oidc/tests/loginflow/authcode_test.php	Adds regression test for manually matched user whose Moodle username differs from their Entra UPN.

Suppressed comments (1)

local/o365/classes/page/acp.php:2085

• This existing-match check is still case-sensitive on the DB column. On case-sensitive DBs, an existing entraidupn stored with different casing won’t be detected, and the insert can create a second connection row differing only by case (unique index won’t prevent it). Use a case-insensitive comparison (e.g. LOWER(entraidupn) = ?) for the lookup.

            $o365username = core_text::strtolower(trim($fromform->o365username));

            // Check existing matches for Microsoft user.
            $existingmatchforo365user = $DB->get_record('local_o365_connections', ['entraidupn' => $o365username]);
            if (!empty($existingmatchforo365user)) {

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.