Page MenuHomePhabricator
Create Task
Maniphest T11828

LDAP username change does not update externalaccount table
Closed, DuplicatePublic
Actions

Description

My Active Directory registered users cannot login to Phabricator after their usernames have been changed.

To reproduce:

  • Register user in Phabricator via LDAP import
  • User can login to Phabricator sucessfully
  • Change user's username in Active Directory
  • Update user's username in Phabricator - People - Manage - Change Username
  • User cannot now login to Phabricator with updated username
  • Manually change username in MySQL phabricator_user.user_externalaccount.username
  • User can now login to Phabricator with the updated username

Version:
phabricator 2f93ce4c25be997ce862247a58038f9a196843f2 (Sun, Nov 6)
arcanist fad85844314b151994769a461825c90f7400c145 (Sat, Oct 22)
phutil e409df2720c262076da73e3d888094341d8ff431 (Fri, Nov 4)

Related Objects

Event Timeline

• ajbattrick created this task.Nov 7 2016, 8:57 AM
Herald added a subscriber: eadler. · View Herald TranscriptNov 7 2016, 8:57 AM
epriestley added a subscriber: epriestley.Nov 7 2016, 3:08 PM

This isn't a bug. Here's an example of why the proposed behavior is dangerous:

  • Alice, a compromised administrator, wants to gain access to Bob's account.
  • Alice changes her Phabricator username to qwzyuxx.
  • Alice changes Bob's username to alice.
  • Alice logs out, then logs in using her LDAP credentials.
  • Alice now controls Bob's account.

I'm going to merge this into T4279.

epriestley closed this task as a duplicate of T4279: Improve auth/LDAP import tools to assist in linking/merging accounts and migrations across providers.Nov 7 2016, 3:08 PM
Phabricator · Built by Phacility