In facebook user settings within an app page, if create local account is not marked as "if user has logged in", new accounts are automatically mapped to the admin user. Is this a known issue? I felt like there was a previous post related but resolved. Note that admin user did not already have a facebook mapping so for some reason facebook user with no drupal account automatically attached to the admin account.

Comments

Dave Cohen’s picture

Dave Cohen commented

If you are logged into drupal already... then click facebook connect button... DFF will connect the account that is already logged in to the facebook account. Is that what happened?

Or, do you have the register users module enabled? If so, accounts that use the same email on facebook and drupal will be mapped.

apmsooner’s picture

apmsooner commented

Neither case. Completely logged out of drupal, clicked facebook connect button, entered fb account info that did not exist in drupal at all, user gets logged in and assigned username of admin with all the admin privileges. I set new users target role to not be administrator for reference.
I did have the register users module enabled but that email did not exist in drupal when new account was created and mapped to admin.

Dave Cohen’s picture

Dave Cohen commented

Huh. Please delete the account - or delete any authmap entries with the same uid. Then clear browser cookies and try to reproduce. If you can, send me the contents of the authmap table, and also go to ?q=fb/devel and let me know what it says there.

Also on your facebook app node, under facebook user settings do you have anything in the last two fields?

apmsooner’s picture

apmsooner commented

Your last statement was the issue. I had 0 entered in both fields. The instructions for the field said 0=anonymous user so guess that field needs to remain blank.
Thanks.

Dave Cohen’s picture

Dave Cohen commented

Hmmmmm... 0 should work. Maybe there is a bug there. THanks for reporting. For now, leave blank if that is a workround.

agileadam’s picture

agileadam
Location Maine, USA
commented
Version: 6.x-2.0-beta4 » 6.x-3.0-beta3

I cannot be certain my issue is the same, but I've noticed some random (sort of) accounts being mapped to the Drupal admin account. We have had 4 accounts (that I know of) get mapped to admin. I know that at least 3 of them are owned by users who have logged into the Drupal side as 'admin' at some point in the past. The fourth, I cannot be certain...

Is there a way for me to disable or disallow user #1 (admin) from connecting with a FB account? Please advise.

Dave Cohen’s picture

Dave Cohen commented

The smart thing to do is administer drupal in one browser, log into facebook in another.

Something like this might work (I have not tested):

function mymodule_hook_fb($op, $data, &$return) {
  if ($op == FB_OP_INIT && $GLOBAL['user']->id == 1) {
    fb_controls(FB_USER_CONTROL_NO_HONOR_MAP, TRUE);
    fb_controls(FB_USER_CONTROL_NO_CREATE_MAP, TRUE);
  }
}
agileadam’s picture

agileadam
Location Maine, USA
commented

Thanks Dave,
I'll give this code a whirl.
I appreciate the prompt response.