mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 02:54:26 +00:00
kevinveenbirkenbachandClaude Opus 5.5
250b89ba4c
Core `auth`, the list of enabled auth plugins, was written only by
05_ldap_sync.yml. Variant 1 of meta/variants.yml is SSO without LDAP and
skips that file, while 04_oidc.yml sets every mdl_user row to
auth='oidc'. Those users point at a plugin the site never enabled.
Moodle 5.3 rejects such a user in validate_auth_not_disabled(), so after
the second deploy of variant 1 the MCP service account, now auth='oidc',
gets "wsaccessusernologin" and "List the MCP tools with the minted
bearer" fails all 30 attempts (main run 39841510219, job 120466819062).
Before 5.3 only a literal 'nologin' was refused, which hid the gap. Users
of variant 1 could not log in at all for the same reason.
04_oidc.yml now enables oidc itself; 05_ldap_sync.yml runs after it and
widens the list to oidc,ldap where both are on. alternateloginurl moves
out of the loop that passes --component=auth_oidc, because core reads it
from mdl_config, not from the plugin's config.
Cherry-picked from dcb8f6866b on feature/store-i18n, with main's
MOODLE_OIDC_PLUGIN_URL_PATH kept for the login URL (Moodle 5.3 serves
the plugin under auth/oidc).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>