>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #2891102. --> Reported by: [faeby](https://www.drupal.org/user/3535315) >>> <h2>Our use case</h2> <ul> <li>we are using ldap and ldap_sso to login</li> <li>ldap is configured not to create drupal account if not already existing</li> <li>drupal accounts are provisionned from external HR system</li> <li>not all existing ldap users are in drupal</li> </ul> <h2>The issue</h2> <p>When an existing ldap user who is not linked to a drupal account reachs the drupal website, it generates report lines like these:</p> <blockquote><p>Notice : Trying to get property of non-object in _drupal_session_write() (line 178 in /var/www/includes/session.inc).</p></blockquote> <p>or</p> <blockquote><p>Notice : Trying to get property of non-object in authcache_key() (line 654 in /var/www/sites/all/modules/authcache/authcache.module).</p></blockquote> <h2>Investigation</h2> <p>These messages happens because ldap_sso sets the gloal $user variable to NULL on line 287 of ldap_sso/ldap_sso.module</p> <pre>&nbsp;&nbsp;&nbsp; // Make sure we're populating the global user object so that we can log this<br>&nbsp;&nbsp;&nbsp; // user in.<br>&nbsp;&nbsp;&nbsp; global $user;<br>&nbsp;&nbsp;&nbsp; $user = ldap_authentication_user_login_authenticate_validate(array(), $fake_form_state, TRUE);</pre><p>The ldap_authentication_user_login_authenticate_validate function return the result of the function _ldap_authentication_user_login_authenticate_validate from the file ldap_authentication/ldap_authentication.inc</p> <p>This function, when everything is working fine, returns the user at line 502.</p> <pre>&nbsp; // the uid is returned so that special login modules, namely ldap sso, can manually call this function.<br>&nbsp; return ($return_user) ? $drupal_account : NULL;</pre><p>But in our case we finish at line 426 with a return; that return NULL, so in ldap_sso we have $user = NULL;</p> <pre>&nbsp;&nbsp;&nbsp; // VI.C.2 Do not provision Drupal account if provisioning disabled<br>&nbsp;&nbsp;&nbsp; if (!$auth_conf-&gt;ldapUser-&gt;provisionEnabled(LDAP_USER_PROV_DIRECTION_TO_DRUPAL_USER, LDAP_USER_DRUPAL_USER_PROV_ON_AUTHENTICATE)) {<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; watchdog('ldap_user', 'Drupal account for authname=%authname account name=%account_name_attr does not exist and provisioning of Drupal accounts on authentication is not enabled', $watchdog_tokens, WATCHDOG_INFO);<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; return;<br>&nbsp;&nbsp;&nbsp; }</pre><h2>Workaround</h2> <p>We check the return value from ldap_authentication_user_login_authenticate_validate and we assign it to the $user variable only if not null.</p> <pre>&nbsp;&nbsp;&nbsp; // Make sure we're populating the global user object so that we can log this<br>&nbsp;&nbsp;&nbsp; // user in.<br>&nbsp;&nbsp;&nbsp; global $user;<br>&nbsp;&nbsp;&nbsp; $validated_user = ldap_authentication_user_login_authenticate_validate(array(), $fake_form_state, TRUE);<br>&nbsp;&nbsp;&nbsp; <br>&nbsp;&nbsp;&nbsp; if ($validated_user !== NULL) {<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $user = $validated_user;<br>&nbsp;&nbsp;&nbsp; } </pre><h2>Proposed solution</h2> <p>The function _ldap_authentication_user_login_authenticate_validate from the file ldap_authentication/ldap_authentication.inc seems to be inconsistent. If the $return_user parameter is set to TRUE, the function should return an user, which is not the case is there is an error (the function returns NULL).</p> <p>It is possible to fix this function's behaviour or to check the result in the ldap_sso module like the workaround.</p> <h2>Steps to reproduce</h2> <ol> <li>Use ldap_sso module</li> <li>Turns on automated/seamsless sso</li> <li>Reachs website with a ldap user who has no linked user in drupal</li> <li>global $user is now null instead of Anonymous</li> </ol>