-
Bug
-
Resolution: Unresolved
-
Minor
-
None
-
4.3.12
-
MOODLE_403_STABLE
Summary
When syncing users via LDAP, if a manual account already exists with the same username, the LDAP user is silently skipped. The task ends with "success", and there is no indication in the task log that a user could not be created.
Steps to reproduce:
- Create a manual user account for Jane Doe with the username doej
- Create a new LDAP user for a different person (e.g. John Doe) using the same username doej
- Run the LDAP sync task
Expected result:
The task should either:
- Attempt to create the user and fail, logging the issue, or
- At minimum: Log that the user could not be created due to a conflicting existing account
Actual result:
The task finishes successfully and silently ignores the conflicting LDAP user. There is no mention in the task log that a user could not be created.
Why this matters:
This behavior hides potential account conflicts and leads to sync inconsistencies that administrators are unaware of. The plugin [auth_ldap_syncplus] suffers from the same problem, and the logic is derived from the core LDAP sync implementation.
Suggested solution:
Change the logic that identifies "missing users" to include only users that do not exist for the current auth method (auth = ldap). This allows conflicts to surface during account creation (e.g. via user_create_user()), where they can be handled via try/catch and logged appropriately.
Related plugin issue:
https://github.com/moodleuulm/moodle-auth_ldap_syncplus/issues/42
Related pull request:
https://github.com/moodleuulm/moodle-auth_ldap_syncplus/pull/43