friloo/wp-m365-login
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions 7

Match accounts by mail address and user principal name
Some checks are pending
CI / PHP lint (7.4) (pull_request) Waiting to run
Details
CI / PHP lint (8.0) (pull_request) Waiting to run
Details
CI / PHP lint (8.1) (pull_request) Waiting to run
Details
CI / PHP lint (8.2) (pull_request) Waiting to run
Details
CI / PHP lint (8.3) (pull_request) Waiting to run
Details
CI / PHP lint (8.4) (pull_request) Waiting to run
Details
CI / WordPress Coding Standards (pull_request) Waiting to run
Details
CI / WordPress.org Plugin Check (pull_request) Waiting to run
Details

Browse source 
Sign-in and sync only used the first address (the mail attribute). A
WordPress account that carries the user principal name while the
Microsoft mail differs was not found at sign-in ("no WordPress account")
and the sync created a duplicate account for it.

Both now try the mail address and then the user principal name (UPN
only for members, only with the UPN fallback on, and only within the
e-mail domain allow-list). Privileged accounts keep the stricter rule;
a matching UPN is sufficient there as well.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Friederich Loheide 2026-09-24 04:23:02 +00:00
parent 81b3a74ae5
commit cc88f145f2
4 changed files with 34 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

7
includes/class-m365-login-sync.php
View file

@ -749,6 +749,11 @@ class M365_Login_Sync {
if ( ! $by_mail ) {
$by_mail = get_user_by( 'email', $email );
}
// The WordPress account may use the user principal name instead of the mail address.
$upn = self::member_upn( $person );
if ( ! $by_mail && '' !== $upn && $upn !== $email && is_email( $upn ) && $this->domain_allowed( $upn ) ) {
$by_mail = get_user_by( 'email', $upn );
}
if ( $by_mail instanceof WP_User ) {
$stored = strtolower( (string) get_user_meta( $by_mail->ID, M365_Login_Auth::META_OID, true ) );
if ( '' !== $stored && $stored !== $oid ) {
@ -1294,7 +1299,7 @@ class M365_Login_Sync {
return false;
}
$assigned = strtolower( (string) get_user_meta( $user->ID, M365_Login_Auth::META_UPN, true ) );
return ( '' !== $assigned && $assigned === $upn ) || ( strtolower( $user->user_email ) === $upn && $upn === $email );
return ( '' !== $assigned && $assigned === $upn ) || strtolower( $user->user_email ) === $upn;
}
/**