search

microsoft / o365-moodle

Office 365 and Azure Active Directory plugins for Moodle
GNU General Public License v3.0
181 stars 136 forks source link

user cannot login via Resource Owner Password Credentials when username changed on both Moodle and Azure AD #1159

Closed duranchen closed 2 weeks ago

duranchen commented 5 years ago

when a username is changed, for example, from 'Holly-Marie.Roberts@outlook.com' to 'holly.hale@outlook.com', even though we change username on both Moodle and Azure AD, the user can not login Moodle via OIDC auth method - Resource Owner Password Credentials Grant. I found the cause, the 'oidcusername' of ''mdl_auth_oidc_token' is still the old one, and when user uses the new username to login, the OIDC plugin will get 'oidcusername' as username to authentication.

could anyone take a look at this ? thanks.

jamesmcq commented 5 years ago

Hi @duranchen - can you confirm the version of the plugins you're using? We recently overhauled the user linking system to avoid this case with username changes.

duranchen commented 5 years ago

Hi @jamesmcq thanks for looking into this. the version I am using is 2018051701

jamesmcq commented 5 years ago

@duranchen Is that the version of local_o365 for Moodle 3.5? If so, the improvements I'm referring to were added to version 2018051708, so I'd try an upgrade and see if that resolves it.

duranchen commented 5 years ago

@jamesmcq thanks, the version 2018051701 is the auth_oidc for Moodle 3.5. I check the latest code, I can not see any changes on this. could you show me the improvements code for this? thanks.

duranchen commented 5 years ago

@jamesmcq sorry again, I would like to clarify it, please see the code below, when the username is changed on both Moodle and Azure AD on the webpage but the 'oidcusername' of 'mdl_auth_oidc_token' is not changed, and the code is using the old oidcusername as username to call $client->rocredsrequest(username,password), which is not right, that's what I refered before.

auth/oidc/classes/loginflow/rocreds.php image

weilai-irl commented 3 years ago

The issue here is actually to support Microsoft account username (upn) change. I'll change this to a feature request.

weilai-irl commented 2 weeks ago

Since Resource Owner Password Credentials flow is deprecated now, I'm going to close this issue.

FYI the Authorization Code Flow now supports UPN change.

Regards, Lai