Bypass ExternalDB for WordPress Admin

Hey @stezter,

Thanks for getting in contact and flagging this issue.

Can you please double check that you haven’t got ‘disable local login’ ticked in the admin area.

If it is not ticked the plugin SHOULD try to login on the external DB and then if it fails to connect, try to login using the WordPress DB.

I believed this to be working but I will have time this weekend to try and replicate this and rectify the issue. I wonder if it’s the migration mode preventing this functionality for some reason.

Keep me posted and I’ll get back to you at latest Sunday with an update.

Thanks,

Tom 🙂

Hey Steve,

I’ve had a look into this to try and replicate. I switched my version of PHP and WordPress to the versions you mentioned and am still finding the functionality working.

To test I’m stopping my docker container of the external database and then checking that I can no longer login with new external users that have not yet been copied to the local WordPress database.

In this situation I can still login with my local admin user.

NEW THOUGHT!

There are two states that block local login as you can see from this code snippet:

        // Whether to disable login fallback with the local WordPress version of the username and password
        // Prevents local login if:
        // - Disable local login  is set in the admin area
        // - OR
        // - The user was found but the password was rejected
        if (exlog_get_option('external_login_option_disable_local_login') == "on" || is_wp_error($user)) {

The first is if disable local login setting is checked, but you’ve checked that you haven’t got that active.

The second is if an external user was found in your external database but the user does not match.

The reason this logic is here is because if your user updates their password in the external database, and that user does exist when we come to try and authenticate in WordPress, we should prevent local login if their password was not validated.

I wonder if you are connecting to the external database and the admin user that you’re trying to login with locally also exists in your external database with the same username?

If this is not the case then the next step is for you to add some error logs that I provide throughout this file and you send me the result of what happens when you login so that we can start debugging what stage is not working for you.

Let me know,

Thanks,

Tom

Hey Steve,

Please find below a complete copy of /external-login/login/authenticate.php.

Could you please copy and paste this over the code that you currently have in that file. It’s indentical but with lots of logs.

<?php
function exlog_auth( $user, $username, $password ){
    $migration_mode = exlog_get_option('external_login_option_migration_mode') == "on";
    error_log(' - - - - - - - -  EXLOG DEBUG START - - - - - - - - ');
    error_log('--- Exlog - Check 1');
    error_log(var_export($migration_mode, true));
    error_log(var_export(username_exists($username), true));
    // If not in migration mode or you are in migration mode and the username isn't in the WordPress DB
    if (!$migration_mode || ($migration_mode && !username_exists($username))) {

        error_log('--- Exlog - Check 2');
        error_log(var_export(username_exists($username), true));
        error_log(var_export(username_exists($password), true));
        // Make sure a username and password are present for us to work with
        if ($username == '' || $password == '') return;

        $response = exlog_auth_query($username, $password);
        error_log('--- Exlog - Auth response');
        error_log(var_export($response, true));

        $roles = exlog_map_role($response['role']);
        error_log('--- Exlog - Roles');
        error_log(var_export($roles, true));

        $block_access_due_to_role = true;
        foreach ($roles as $role) {
            if ($role != EXLOG_ROLE_BLOCK_VALUE) {
                $block_access_due_to_role = false;
            }
        }

        error_log('--- Exlog - Block access due to role?');
        error_log(var_export($block_access_due_to_role, true));
        // If a user was found
        if ($response) {
            error_log('--- Exlog - In user found');
            // If role is blocking user access
            if ($block_access_due_to_role) {
                error_log('--- Exlog - In block acces due to role');
                $user = new WP_Error('denied', __("You are not allowed access"));

                // If user was NOT authenticated
            } else if (!($response["exlog_authenticated"])) {
                error_log('--- Exlog - In Not authenticated');
                // User does not exist, send back an error message
                $user = new WP_Error('denied', __("Invalid username or password"));

                // If user was authenticated
            } else if ($response["exlog_authenticated"]) {
                error_log('--- Exlog - In Authenticated');
                // External user exists, try to load the user info from the WordPress user table
                $userobj = new WP_User();
                $user = $userobj->get_data_by('login', $response['username']); // Does not return a WP_User object 🙁
                $user = new WP_User($user->ID); // Attempt to load up the user with that ID
                error_log('--- Exlog - User');
                error_log(var_export($user, true));

                $exlog_userdata = array(
                    'user_login' => $response['username'],
                    'first_name' => $response['first_name'],
                    'last_name'  => $response['last_name'],
                    'user_pass'  => $password,
                    'role'       => $roles[0],
                    'user_email' => $response['email'],
                );
                error_log('--- Exlog - Exlog user data');
                error_log(var_export($user, true));

                // If user does not exist
                if ($user->ID == 0) {
                    // Setup the minimum required user information

                    $new_user_id = wp_insert_user( $exlog_userdata ); // A new user has been created

                    // Load the new user info
                    $user = new WP_User ($new_user_id);
                    error_log('--- Exlog - NEW user');
                    error_log(var_export($user, true));
                } else {
                    error_log('--- Exlog - Update user');
                    error_log(var_export($user, true));
                    $exlog_userdata['ID'] = $user->ID;

                    add_filter('send_password_change_email', '__return_false'); // Prevent password update e-mail

                    wp_update_user($exlog_userdata);
                }

                error_log('--- Exlog - Setting roles');
                $user->set_role($roles[0]); // Wipe out old roles

                // Add roles to user if more than one
                foreach ($roles as $role) {
                    $user->add_role($role);
                }

                error_log('--- Exlog - Call authenticated hook');
                // Hook that passes user data on successful login
                do_action('exlog_hook_action_authenticated', $user, $exlog_userdata);
            }
        }

        // Whether to disable login fallback with the local WordPress version of the username and password
        // Prevents local login if:
        // - Disable local login  is set in the admin area
        // - OR
        // - The user was found but the password was rejected
        error_log('--- Exlog - Should block local login?');
        error_log(var_export(exlog_get_option('external_login_option_disable_local_login') == "on" || is_wp_error($user), true));
        error_log(var_export(exlog_get_option('external_login_option_disable_local_login') == "on", true));
        error_log(var_export(is_wp_error($user), true));
        if (exlog_get_option('external_login_option_disable_local_login') == "on" || is_wp_error($user)) {
            error_log('--- Exlog - BLOCKING local login');
            remove_action('authenticate', 'wp_authenticate_username_password', 20);
        }
    }

    error_log(' - - - - - - - -  EXLOG DEBUG END - - - - - - - - ');
    return $user;
}

if (exlog_get_option("external_login_option_enable_external_login") == "on") {
    error_log(' - - - - - - - -  EXLOG DEBUG END - - - - - - - - ');
    add_filter('authenticate', 'exlog_auth', 10, 3);
} else {
    error_log(' - - - - - - - -  EXLOG DEBUG PLUGIN NOT ACTIVATED!!! - - - - - - - - ');
}

I think I’m going to make a feature out of showing these logs soon to help with these situations.

Could you then login in the situation that is not working. Finally look at your PHP error logs and share with me what came out between:

error_log(' - - - - - - - - EXLOG DEBUG START - - - - - - - - ');
and
error_log(' - - - - - - - - EXLOG DEBUG END - - - - - - - - ');

IMPORTANT!!! Please make sure of obfuscate private and personal data.

We’ll get there 😛

Tom

• This reply was modified 3 years, 6 months ago by tbenyon.
• This reply was modified 3 years, 6 months ago by tbenyon.