[4.1] Disable auth binding code introduced with 4.1.1

administrator/components/com_admin/script.php

@@ -9,13 +9,15 @@
 
 defined('_JEXEC') or die;
 
+use Joomla\CMS\Authentication\ProviderAwareAuthenticationPluginInterface;
 use Joomla\CMS\Extension\ExtensionHelper;
 use Joomla\CMS\Factory;
 use Joomla\CMS\Filesystem\File;
 use Joomla\CMS\Filesystem\Folder;
 use Joomla\CMS\Installer\Installer;
 use Joomla\CMS\Language\Text;
 use Joomla\CMS\Log\Log;
+use Joomla\CMS\Plugin\PluginHelper;
 use Joomla\CMS\Table\Table;
 use Joomla\Component\Fields\Administrator\Model\FieldModel;
 use Joomla\Database\ParameterType;
@@ -106,6 +108,7 @@ public function update($installer)
 		$this->clearStatsCache();
 		$this->convertTablesToUtf8mb4(true);
 		$this->addUserAuthProviderColumn();
+		$this->verifyAuthProviders();
 		$this->cleanJoomlaCache();
 	}
 
@@ -8685,4 +8688,37 @@ protected function addUserAuthProviderColumn(): void
 			return;
 		}
 	}
+
+	/**
+	 * Verifies the current authProvider values in the user table and unsets invalid values
+	 *
+	 * @throws Exception
+	 */
+	protected function verifyAuthProviders(): void
+	{
+		$plugins = PluginHelper::getPlugin('authentication');
+		$db = Factory::getContainer()->get('DatabaseDriver');
+
+		$validProviders = [];
+
+		foreach ($plugins as $plugin)
+		{
+			$plugin = Factory::getApplication()->bootPlugin($plugin->name, $plugin->type);
+
+			// Check auth provider constraint
+			if ($plugin instanceof ProviderAwareAuthenticationPluginInterface
+				&& $plugin::isPrimaryProvider())
+			{
+				$validProviders[] = $plugin::getProviderName();
+			}
+		}
+
+		$query = $db->getQuery(true);
+
+		$query->update($db->quoteName('#__users'))
+			->set($db->quoteName('authProvider') . ' = ' . $db->quote(''))
+			->whereNotIn($db->quoteName('authProvider'), $validProviders, ParameterType::STRING);
+
+		$db->setQuery($query)->execute();
+	}
 }

plugins/user/joomla/joomla.php

@@ -9,6 +9,7 @@
 
 defined('_JEXEC') or die;
 
+use Joomla\CMS\Authentication\ProviderAwareAuthenticationPluginInterface;
 use Joomla\CMS\Component\ComponentHelper;
 use Joomla\CMS\Factory;
 use Joomla\CMS\Language\LanguageFactoryInterface;
@@ -412,7 +413,15 @@ protected function _getUser($user, $options = [])
 			// Add auth provider constraint if not set yet
 			if (!$instance->authProvider)
 			{
-				$instance->setAuthProvider($user['type']);
+				$plugin = Factory::getApplication()->bootPlugin($user['type'], 'authentication');
+
+				// Check auth provider constraint
+				if ($plugin
+					&& $plugin instanceof ProviderAwareAuthenticationPluginInterface
+					&& $plugin::isPrimaryProvider())
+				{
+					$instance->setAuthProvider($user['type']);
+				}
 			}
 
 			return $instance;