UserProvisioningService
class UserProvisioningService (View source)
Creates or updates the local user for an LDAP, OIDC or SAML login and maps their groups to a permission template.
Constants
| AUTH_METHOD_SQL |
Aliases kept for callers; {AuthMethod} owns the vocabulary. |
| AUTH_METHOD_LDAP |
|
| AUTH_METHOD_OIDC |
|
| AUTH_METHOD_SAML |
|
| AUTH_METHOD_REMOTE_USER |
|
| private LINKABLE_AUTH_METHODS |
Methods with an identity link table; LDAP identity is the username itself. |
Methods
No description
Sync an already-matched user from external auth data. Identity fields, template mapping and group membership are driven by the auth method's config section; nothing is written when the data is unchanged.
The account id for an external identity, creating or linking it as configured.
Whether a matched account may sign in; provisionUser() can return a disabled account.
The stored username, full name and email of an account, which the session shows; provisioning has already synced them from the provider where it sent any.
Get the database username for a user ID Used to set correct session username when linking existing users
Clean up orphaned external authentication links This method finds and removes OIDC/SAML links that point to non-existent users
Details
__construct(ConfigurationInterface $configManager, LoggerInterface $logger, UserRepositoryInterface $userRepository, ExternalIdentityRepositoryInterface $identities, UserGroupLookupInterface $groups, UserGroupMemberRepositoryInterface $groupMembers, LastSuperAdminGuard|null $superAdminGuard = null)
No description
void
syncExistingUser(int $userId, UserInfoInterface $userInfo)
Sync an already-matched user from external auth data. Identity fields, template mapping and group membership are driven by the auth method's config section; nothing is written when the data is unchanged.
int|null
provisionUser(UserInfoInterface $userInfo, string $providerId)
The account id for an external identity, creating or linking it as configured.
The id may belong to a disabled account; callers check isActiveUser() before signing in.
bool
isActiveUser(int $userId)
Whether a matched account may sign in; provisionUser() can return a disabled account.
array|null
accountProfile(int $userId)
The stored username, full name and email of an account, which the session shows; provisioning has already synced them from the provider where it sent any.
string|null
getDatabaseUsername(int $userId)
Get the database username for a user ID Used to set correct session username when linking existing users
array
cleanupOrphanedAuthLinks()
Clean up orphaned external authentication links This method finds and removes OIDC/SAML links that point to non-existent users