User login reset first name, last name, email address and id number of auth_oidc users, regardless of mapping settings

[weilai-irl]

We have noticed that on every user login for users using auth_oidc, Moodle users' first name, last name, email address and ID number profile fields are always synced to the value set in Office 365, regardless of profile field settings in local_o365.

This needs to be addressed.

[danmarsden]

just commented on one of those PR's - changing one hard-coded value to another hard-coded value is the wrong approach - what really needs to happen is the ability for an admin to choose what is locked/unlocked etc - like the core auth plugins - and like some of the other 3rd party auth plugins.

[weilai-irl]

@danmarsden

Hi Dan,

Thank you for your comments. Please see my reply at #1429 (comment).

In short, I agree adding the lock option would be desired, and will be created as a feature request, and implemented in the near future releases. Field mapping and sync options are existing features, and will stay at their current location, but links will be added to auth_oidc to point to it.

Regards,
Lai

[danmarsden]

Thanks @weilai-irl - basically all of the hard-coded items in that "forced_config" array here:
https://github.com/microsoft/moodle-auth_oidc/blob/master/classes/loginflow/base.php#L43

should really be configurable so that the admin can choose what is locked, and when these fields should be updated (on login/on create/never) - sometimes the external Auth connection is used only for authentication purposes, and an HR sync process or other external source is used for other user profile fields so you don't want the authentication plugin to overwrite what is stored in Moodle.

[weilai-irl]

Hi @danmarsden,

Thank you for your comments. I agree they make sense. We will log this a potential improvement and schedule it for upcoming releases.

Regards,
Lai