Skip to content

Skip email sync with Auth0 when we know the update is coming from Auth0 - #831

Merged
evansims merged 2 commits into
auth0:masterfrom
drobin03:skip_sync_for_updated_email_from_auth0
Oct 15, 2021
Merged

evansims merged 2 commits into
auth0:masterfrom
drobin03:skip_sync_for_updated_email_from_auth0

Conversation

@drobin03

@drobin03 drobin03 commented Jun 24, 2021 •

Copy link
Copy Markdown
Contributor

Description

When a user's email is updated in Auth0 and they log in on wordpress, the new email doesn't get saved to wp_users. The code I'm modifying here is meant to save that update, and does, but it is reverted by the wp_auth0_profile_change_email hook because it is unable to apply that change to Auth0 (due to our app not having management api access I presume).

Since this particular wp_update_user call is always called with fresh data from the Auth0 ID token, I don't see a reason we should be attempting to sync with Auth0 afterwards. My code change here temporarily removes the wp_auth0_profile_change_email hook to allow us to save the new email address, and then re-enables the hook after it is finished.

I discovered this issue on a clients website when our Auth0 instance stopped including the email in the ID token (due to some account changes). This resulted in a number of users on our site being created with an email following this format change_this_email@<uniqid> .com in wp_users. Once we resolved the issue with the ID token, I assumed that the next time each user logged in, their email address would be updated to the correct email from the ID token. However when I tested it, I noticed that the email change would save, and then immediately get reverted. With this fix in place locally, the email saved as-expected, and my user accounts were up-to-date.

Testing

  1. With a basic WP site, using the embedded lock form (not universal login), and Auto-provisioning turned on.
  2. Log in with an Auth0 user for the first time, verify that the user was created in wp_users
  3. Change the user_email value from the wp_users record to something different
  4. Log in as the same user again, verify that the user_email was not updated

@drobin03
drobin03 requested a review from a team as a code owner June 24, 2021 17:44
@drobin03 drobin03 changed the title Skip email sync when update is coming from Auth0 Skip email sync with Auth0 when we know the update is coming from Auth0 Jun 24, 2021
@evansims

Copy link
Copy Markdown
Contributor

Hey, @drobin03 👋 Thanks very much for the PR! Give me a little to review this and I'll circle back on this with you

@evansims
evansims self-requested a review June 25, 2021 12:58
@stale stale Bot added the closed:stale label Oct 2, 2021
@auth0 auth0 deleted a comment from stale Bot Oct 2, 2021
@evansims evansims self-assigned this Oct 2, 2021

@evansims evansims left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sincere apologies for the long delay in me getting time to look into this one @drobin03; these changes look good to me from my testing. I'll get them merged in for the next release. Thanks for your contribution!

@evansims
evansims merged commit 78eb22c into auth0:master Oct 15, 2021
@evansims evansims mentioned this pull request Oct 15, 2021
@github-actions github-actions Bot locked as resolved and limited conversation to collaborators Sep 19, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants