Suppressing New User Blog Addition

Huh, weird that your add_user_to_blog hook isn’t working, that seems right to me.

We’ll try to poke at it next week and see what we can find!

Hi Paul,

Thanks for the response! I’m reviewing the plugin after some time away and am still testing the functionality for our use case. At the moment, I actually have all of the `add_user_to_blog’ calls throughout the code commented out, just to make sure it wasn’t an issue with the hook I wrote and to minimize the places I need to look. I also disabled all other plugins on my site and tested the hooks below.

// this fires first
add_action('user_register', 'register_check', PHP_INT_MAX, 2);
function register_check($user_id, $userdata)
{
	if ('' === $userdata['role'] || is_null($userdata)) {
		remove_user_from_blog($user_id, get_current_blog_id());
	}
}

// then this
add_action('authorizer_user_register', 'authorizer_user_check', PHP_INT_MAX, 2);
function authorizer_user_check($user, $user_data)
{
	if (0 == count($user->roles)) {
		remove_user_from_blog($user->id, get_current_blog_id());
	}
}

If I wp_die() after the remove_user_from_blog() calls in either hook, it works correctly — the user shows up at the network level, presumably gets added at the blog level, and then the user is removed during the hook. So success, since the user doesn’t show up at the blog level…

However, when I remove the wp_die() and let it continue, something is still adding those users at the blog level after either one. Any insight you could provide would be greatly appreciated. Thanks so much!

Weird. Maybe next try looking in the core multisite functions, comment out those calls to add_user_to_blog():

wp-includes/ms-functions.php
65:     // TODO: Review this call to add_user_to_blog too - to get here the user must have a role on this blog?
66:     $result = add_user_to_blog( $first_blog->userblog_id, $user_id, 'subscriber' );
142: * Use the {@see 'add_user_to_blog'} action to fire an event when users are added to a blog.
152:function add_user_to_blog( $blog_id, $user_id, $role ) {
173:    $can_add_user = apply_filters( 'can_add_user_to_blog', true, $user_id, $role, $blog_id );
202:    do_action( 'add_user_to_blog', $user_id, $role, $blog_id );
2308:       $result  = add_user_to_blog( $blog_id, $details['user_id'], $details['role'] );
2328: * To add a user in general, use add_user_to_blog(). This function
2333: * @see add_user_to_blog()
2345:       $result = add_user_to_blog( $blog_id, $user_id, $role );

What role is the user getting? If it’s subscriber I’d be suspicious of that first result with the TODO mark.

Thanks again for the quick reply and great suggestion! I went through and commented out the multisite add_user_to_blog() calls, but that doesn’t appear to be the issue. I still have an add_user_to_blog hook in my functions.php file that wasn’t firing, so I figured that should be firing if it was one of those multisite add_user_to_blog() calls, or a call from anywhere else.

I have the “–NONE–” default role set in the Authorizer settings at the network level, and that appears to be applying correctly since all newly created users through CAS authorization have a null role after creation.

Your hunch to look at core functions seems correct, since as far as I can tell, the plugin itself cannot add users to blogs with my current setup. Or at least if it does, the user should be immediately removed after the addition.

Hey Paul,

I think I’ve figured it out. I placed a function at the end of the check_user_access() method and noticed that users were being created somewhere between the authorizer_user_register action and the end of the method that wasn’t being picked up by one of my hooks.

On a whim I hooked into the updated_user_meta action to add the following:

$user_data = get_userdata($object_id);
	if (0 === count($user_data->roles)) {
		remove_user_from_blog($user_data->ID, get_current_blog_id());
	}

I don’t see anything in the docs, but the update must be creating the object — in this case a user object — if it doesn’t exist? Either way, with that hook in place, users are now correctly being added to the network level after authentication, but not at the blog level because they are being immediately deleted from the blog.

Thanks again for all your help!

Oh interesting, yeah that sounds like the case. Nice sleuthing, looks like a good solution!