Background

In MDL-21559 some code was added to set user passwords to the string "not cached" when those accounts are using an "external" authentication method. At this point in time, the user_create_user and user_update_user functions did not have a parameter to update the password for the user - that was later added in MDL-39961 (which oddly doesn't seem to mention it at all, but commit bb78e249 does appear to confirm this).

It looks like there was an oversight when adding this flag, as for internal authentications methods, it does not set the password to "not cached".

Observations

The following has been observed with regard to changing the users password in various ways.

Manual user with a password, update via CSV

1. Create a manual user with a password
2. Create a CSV to update the user's authentication method to SAML2
3. When uploading the CSV, choose to not update the password
4. Complete the upload

In the above scenario, the user's password is changed to "not cached".

Manual user with a password, update via editing the user

1. Create a manual user with a password
2. Edit the user, updating their authentication method to SAML2

In the above scenario, the user's password is not updated, the retain whatever password was provided in step 1.

Additionally, using the user_create_user function directly, does not set the password to "not cached" if the user's authentication method is set to an external authentication method (such as SAML2).

Suggestion

A sensible approach to me seems like the following:

• When a user is created, via any means, with an external authentication method, set the password to not cached
• When a user is updated, via any means, and the authentication method changes from an external authentication to an internal one (e.g., manual -> SAML2), retain their existing password - this way if the user is then switched back to an internal authentication method, their pre-existing password still works

On the other hand, the comment here indicates that it should always be "not cached" regardless of if it's a new user being created, or an existing user being updated.