Automatically Create Accounts option issues

Under the new 2.0 version of the plugin, the account creation behavior has changed and it has created a security issue.

In the previous version, accounts would be automatically created if the credentials logging into the site were mapped to a role. If they were not mapped to a role, even if their credentials were accepted by the SSO authority, the account would not be created and they would be denied access to the site.

Under the current version, accounts are not created by default, even if they map to a role, unless the option is enabled; something we have to go and retroactively enable across about 100 websites. Further, once enabled, all accounts will be created, even if they do not map to a role, and it automatically maps to subscriber. This is an issue because on all our sites, we manage the roles externally in LDAP, and granting subscriber access by default gives everybody who attempts a login, access to the site. This is a big security flaw for those who do not want to grant arbitrary access to their site.

This fix is that we either have to create a custom role called “none”, push that out to all the sites, and then configure all the sites to default to that role within your plugin. (a big huge mess / hack)

…or, instead of a binary choice on that option, you can make it a drop-down choice.

– Create Account if mapped to Role, Deny Access if no mapped Role (previous behavior)
– Create Account if mapped to Role, Assign to default Role if no mapped Role (current behavior option)
– Do not create accounts (current behavior option)