Fix issue 25390 (#25403)

server/channels/api4/saml_test.go

@@ -60,7 +60,7 @@ func TestSamlResetId(t *testing.T) {
 	th.App.Channels().Saml = &mocks.SamlInterface{}
 
 	user := th.BasicUser
-	_, appErr := th.App.UpdateUserAuth(user.Id, &model.UserAuth{
+	_, appErr := th.App.UpdateUserAuth(nil, user.Id, &model.UserAuth{
 		AuthData:    model.NewString(model.NewId()),
 		AuthService: model.UserAuthServiceSaml,
 	})

server/channels/api4/user.go

@@ -1609,7 +1609,7 @@ func updateUserAuth(c *Context, w http.ResponseWriter, r *http.Request) {
 		auditRec.AddEventPriorState(user)
 	}
 
-	user, err := c.App.UpdateUserAuth(c.Params.UserId, &userAuth)
+	user, err := c.App.UpdateUserAuth(c.AppContext, c.Params.UserId, &userAuth)
 	if err != nil {
 		c.Err = err
 		return

server/channels/app/app_iface.go

@@ -1153,7 +1153,7 @@ type AppIface interface {
 	UpdateUser(c request.CTX, user *model.User, sendNotifications bool) (*model.User, *model.AppError)
 	UpdateUserActive(c request.CTX, userID string, active bool) *model.AppError
 	UpdateUserAsUser(c request.CTX, user *model.User, asAdmin bool) (*model.User, *model.AppError)
-	UpdateUserAuth(userID string, userAuth *model.UserAuth) (*model.UserAuth, *model.AppError)
+	UpdateUserAuth(c request.CTX, userID string, userAuth *model.UserAuth) (*model.UserAuth, *model.AppError)
 	UpdateUserRoles(c request.CTX, userID string, newRoles string, sendWebSocketEvent bool) (*model.User, *model.AppError)
 	UpdateUserRolesWithUser(c request.CTX, user *model.User, newRoles string, sendWebSocketEvent bool) (*model.User, *model.AppError)
 	UploadData(c request.CTX, us *model.UploadSession, rd io.Reader) (*model.FileInfo, *model.AppError)

server/channels/app/opentracing/opentracing_layer.go

@@ -18157,7 +18157,7 @@ func (a *OpenTracingAppLayer) UpdateUserAsUser(c request.CTX, user *model.User,
 	return resultVar0, resultVar1
 }
 
-func (a *OpenTracingAppLayer) UpdateUserAuth(userID string, userAuth *model.UserAuth) (*model.UserAuth, *model.AppError) {
+func (a *OpenTracingAppLayer) UpdateUserAuth(c request.CTX, userID string, userAuth *model.UserAuth) (*model.UserAuth, *model.AppError) {
 	origCtx := a.ctx
 	span, newCtx := tracing.StartSpanWithParentByContext(a.ctx, "app.UpdateUserAuth")
 
@@ -18169,7 +18169,7 @@ func (a *OpenTracingAppLayer) UpdateUserAuth(userID string, userAuth *model.User
 	}()
 
 	defer span.Finish()
-	resultVar0, resultVar1 := a.app.UpdateUserAuth(userID, userAuth)
+	resultVar0, resultVar1 := a.app.UpdateUserAuth(c, userID, userAuth)
 
 	if resultVar1 != nil {
 		span.LogFields(spanlog.Error(resultVar1))

server/channels/app/plugin_api.go

@@ -324,6 +324,10 @@ func (api *PluginAPI) UpdateUser(user *model.User) (*model.User, *model.AppError
 	return api.app.UpdateUser(api.ctx, user, true)
 }
 
+func (api *PluginAPI) UpdateUserAuth(userID string, userAuth *model.UserAuth) (*model.UserAuth, *model.AppError) {
+	return api.app.UpdateUserAuth(api.ctx, userID, userAuth)
+}
+
 func (api *PluginAPI) UpdateUserActive(userID string, active bool) *model.AppError {
 	return api.app.UpdateUserActive(api.ctx, userID, active)
 }

server/channels/app/plugin_api_tests/test_update_user_auth_plugin/main.go

@@ -0,0 +1,87 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package main
+
+import (
+	"fmt"
+
+	"github.com/mattermost/mattermost/server/public/model"
+	"github.com/mattermost/mattermost/server/public/plugin"
+	"github.com/mattermost/mattermost/server/v8/channels/app/plugin_api_tests"
+)
+
+type MyPlugin struct {
+	plugin.MattermostPlugin
+	configuration plugin_api_tests.BasicConfig
+}
+
+func (p *MyPlugin) OnConfigurationChange() error {
+	if err := p.API.LoadPluginConfiguration(&p.configuration); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (p *MyPlugin) expectUserAuth(userID string, expectedUserAuth *model.UserAuth) error {
+	user, err := p.API.GetUser(p.configuration.BasicUserID)
+	if err != nil {
+		return err
+	}
+	if user.AuthService != expectedUserAuth.AuthService {
+		return fmt.Errorf("expected '%s' got '%s'", expectedUserAuth.AuthService, user.AuthService)
+	}
+	if user.AuthData == nil && expectedUserAuth.AuthData != nil {
+		return fmt.Errorf("expected '%s' got nil", *expectedUserAuth.AuthData)
+	} else if user.AuthData != nil && expectedUserAuth.AuthData == nil {
+		return fmt.Errorf("expected nil got '%s'", *user.AuthData)
+	} else if user.AuthData != nil && expectedUserAuth.AuthData != nil && *user.AuthData != *expectedUserAuth.AuthData {
+		return fmt.Errorf("expected '%s' got '%s'", *expectedUserAuth.AuthData, *user.AuthData)
+	}
+
+	return nil
+}
+
+func (p *MyPlugin) MessageWillBePosted(_ *plugin.Context, _ *model.Post) (*model.Post, string) {
+	// BasicUser2 should remain unchanged throughout
+	user, appErr := p.API.GetUser(p.configuration.BasicUser2Id)
+	if appErr != nil {
+		return nil, appErr.Error()
+	}
+	expectedUser2Auth := &model.UserAuth{
+		AuthService: user.AuthService,
+		AuthData:    user.AuthData,
+	}
+
+	// Update BasicUser to SAML
+	expectedUserAuth := &model.UserAuth{
+		AuthService: model.UserAuthServiceSaml,
+		AuthData:    model.NewString("saml_auth_data"),
+	}
+	_, appErr = p.API.UpdateUserAuth(p.configuration.BasicUserID, expectedUserAuth)
+	if appErr != nil {
+		return nil, appErr.Error()
+	}
+
+	p.expectUserAuth(p.configuration.BasicUserID, expectedUserAuth)
+	p.expectUserAuth(p.configuration.BasicUser2Id, expectedUser2Auth)
+
+	// Update BasicUser to LDAP
+	expectedUserAuth = &model.UserAuth{
+		AuthService: model.UserAuthServiceLdap,
+		AuthData:    model.NewString("ldap_auth_data"),
+	}
+	_, err := p.API.UpdateUserAuth(p.configuration.BasicUserID, expectedUserAuth)
+	if err != nil {
+		return nil, err.Error()
+	}
+
+	p.expectUserAuth(p.configuration.BasicUserID, expectedUserAuth)
+	p.expectUserAuth(p.configuration.BasicUser2Id, expectedUser2Auth)
+
+	return nil, "OK"
+}
+
+func main() {
+	plugin.ClientMain(&MyPlugin{})
+}

server/channels/app/user.go

@@ -1109,7 +1109,7 @@ func (a *App) PatchUser(c request.CTX, userID string, patch *model.UserPatch, as
 	return updatedUser, nil
 }
 
-func (a *App) UpdateUserAuth(userID string, userAuth *model.UserAuth) (*model.UserAuth, *model.AppError) {
+func (a *App) UpdateUserAuth(c request.CTX, userID string, userAuth *model.UserAuth) (*model.UserAuth, *model.AppError) {
 	if _, err := a.Srv().Store().User().UpdateAuthData(userID, userAuth.AuthService, userAuth.AuthData, "", false); err != nil {
 		var invErr *store.ErrInvalidInput
 		switch {
@@ -1120,6 +1120,8 @@ func (a *App) UpdateUserAuth(userID string, userAuth *model.UserAuth) (*model.Us
 		}
 	}
 
+	a.InvalidateCacheForUser(userID)
+
 	return userAuth, nil
 }