Levels

membership/members/views.py

@@ -168,16 +168,23 @@ def link_identity(claims):
         raise ValueError("A verified Dex identity is required.")
     identity = directory.identity_for_login(claims.get("preferred_username"))
     federated = claims.get("federated_claims") or {}
-    if federated.get("connector_id") != settings.DEX_CONNECTOR_ID or federated.get("user_id") != identity["ldap_uuid"]:
-        raise ValueError("Dex must authenticate the configured LDAP connector with entryUUID as idAttr.")
+    if federated.get("connector_id") != settings.DEX_CONNECTOR_ID or federated.get("user_id") != identity["uid"]:
+        raise ValueError("Dex must authenticate the configured LDAP connector with uid as idAttr.")
     if identity["email"].casefold() != str(claims.get("email", "")).casefold():
         raise ValueError("Dex and LDAP email disagree.")
-    # Link using the signed LDAP uid plus immutable entryUUID, NEVER by email.
+    # Resolve by immutable LDAP entryUUID, never by email. Dex's federated user
+    # ID remains uid so the unified connector preserves existing OIDC subjects.
     with transaction.atomic():
+        uid_owner = Account.objects.filter(uid=identity["uid"]).first()
+        if uid_owner and uid_owner.ldap_uuid != identity["ldap_uuid"]:
+            raise ValueError("Username is already linked to another directory entry.")
         account, _ = Account.objects.get_or_create(ldap_uuid=identity["ldap_uuid"], defaults=identity)
         account = Account.objects.select_for_update().get(pk=account.pk)
-        if account.oidc_sub and account.oidc_sub != claims["sub"]:
-            raise ValueError("Identity is already linked to another Dex subject.")
+        subject_owner = Account.objects.filter(oidc_sub=claims["sub"]).exclude(pk=account.pk).exists()
+        if subject_owner:
+            raise ValueError("Dex subject is already linked to another directory entry.")
+        # A previous login may have used the retired www-ldap connector, whose
+        # subjects used entryUUID. Rebind after validating the same LDAP entry.
         account.oidc_sub = claims["sub"]
         account.email = identity["email"]
         account.ldap_dn = identity["ldap_dn"]