Resolved configured auth provider plugin

CHANGELOG.md

@@ -8,6 +8,12 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 
 ## [Unreleased]
 
+## [2.5.1] 2026-07-16
+
+* Resolved auth provider plugin from webform NemID settings (`session_type`)
+  instead of always using the site-wide active plugin when setting
+  organisation user id and when checking webform access.
+
 ## [2.5.0] 2026-07-14
 
 * Use unique token keys for OIDC providers.
@@ -53,7 +59,8 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 
 * Allowed multiple providers.
 
-[Unreleased]: https://github.com/itk-dev/os2forms_nemlogin_openid_connect/compare/2.5.0...HEAD
+[Unreleased]: https://github.com/itk-dev/os2forms_nemlogin_openid_connect/compare/2.5.1...HEAD
+[2.5.1]: https://github.com/itk-dev/os2forms_nemlogin_openid_connect/compare/2.5.0...2.5.1
 [2.5.0]: https://github.com/itk-dev/os2forms_nemlogin_openid_connect/compare/2.4.1...2.5.0
 [2.4.1]: https://github.com/itk-dev/os2forms_nemlogin_openid_connect/compare/2.4.0...2.4.1
 [2.4.0]: https://github.com/itk-dev/os2forms_nemlogin_openid_connect/compare/2.3.1...2.4.0

os2forms_nemlogin_openid_connect.services.yml

@@ -9,13 +9,14 @@ services:
       - '@os2web_nemlogin.auth_provider'
       - '@messenger'
       - '@current_route_match'
+      - '@webform.request'
 
   Drupal\os2forms_nemlogin_openid_connect\Helper\Settings:
     arguments:
       - "@keyvalue"
 
   Drupal\os2forms_nemlogin_openid_connect\EventSubscriber\OrganisationEventSubscriber:
     arguments:
-      - '@os2web_nemlogin.auth_provider'
+      - '@Drupal\os2forms_nemlogin_openid_connect\Helper\WebformHelper'
     tags:
       - { name: 'event_subscriber' }

src/EventSubscriber/OrganisationEventSubscriber.php

@@ -3,8 +3,8 @@
 namespace Drupal\os2forms_nemlogin_openid_connect\EventSubscriber;
 
 use Drupal\Component\Plugin\Exception\PluginException;
+use Drupal\os2forms_nemlogin_openid_connect\Helper\WebformHelper;
 use Drupal\os2forms_organisation\Event\OrganisationUserIdEvent;
-use Drupal\os2web_nemlogin\Service\AuthProviderService;
 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
 
 /**
@@ -13,17 +13,17 @@
 class OrganisationEventSubscriber implements EventSubscriberInterface {
 
   /**
-   * The OS2Web Nemlogin authorization provider.
+   * The webform helper.
    *
-   * @var \Drupal\os2web_nemlogin\Service\AuthProviderService
+   * @var \Drupal\os2forms_nemlogin_openid_connect\Helper\WebformHelper
    */
-  protected AuthProviderService $authProvider;
+  protected WebformHelper $webformHelper;
 
   /**
    * The constructor.
    */
-  public function __construct(AuthProviderService $authProvider) {
-    $this->authProvider = $authProvider;
+  public function __construct(WebformHelper $webformHelper) {
+    $this->webformHelper = $webformHelper;
   }
 
   /**
@@ -54,11 +54,15 @@ public function setOrganisationUserId(OrganisationUserIdEvent $event): void {
     }
 
     try {
-      $plugin = $this->authProvider->getActivePlugin();
+      // Use the plugin configured on the current webform.
+      $plugin = $this->webformHelper->getAuthProviderPlugin();
 
-      if ($plugin->isAuthenticated() && !empty($plugin->fetchValue('nameidentifier'))) {
-        /* @phpstan-ignore-next-line */
-        $event->setUserId($plugin->fetchValue('nameidentifier'));
+      if ($plugin->isAuthenticated()) {
+        $userId = $plugin->fetchValue('nameidentifier');
+        if (!empty($userId)) {
+          /* @phpstan-ignore-next-line */
+          $event->setUserId($userId);
+        }
       }
     }
     catch (PluginException $exception) {

src/Helper/WebformHelper.php

@@ -6,9 +6,11 @@
 use Drupal\Core\Messenger\MessengerInterface;
 use Drupal\Core\Routing\RouteMatchInterface;
 use Drupal\Core\StringTranslation\StringTranslationTrait;
+use Drupal\os2web_nemlogin\Plugin\AuthProviderInterface;
 use Drupal\os2web_nemlogin\Service\AuthProviderService;
 use Drupal\webform\Utility\WebformFormHelper;
 use Drupal\webform\WebformInterface;
+use Drupal\webform\WebformRequestInterface;
 use Drupal\webform\WebformSubmissionInterface;
 use Symfony\Component\Yaml\Yaml;
 
@@ -41,13 +43,47 @@ class WebformHelper {
    */
   private RouteMatchInterface $routeMatch;
 
+  /**
+   * The webform request handler.
+   *
+   * @var \Drupal\webform\WebformRequestInterface
+   */
+  private WebformRequestInterface $webformRequest;
+
   /**
    * Constructor.
    */
-  public function __construct(AuthProviderService $authProviderService, MessengerInterface $messenger, RouteMatchInterface $routeMatch) {
+  public function __construct(AuthProviderService $authProviderService, MessengerInterface $messenger, RouteMatchInterface $routeMatch, WebformRequestInterface $webformRequest) {
     $this->authProviderService = $authProviderService;
     $this->messenger = $messenger;
     $this->routeMatch = $routeMatch;
+    $this->webformRequest = $webformRequest;
+  }
+
+  /**
+   * Get auth provider plugin for a webform.
+   *
+   * Resolves the plugin from the webform's NemID settings (session_type),
+   * matching how os2forms_nemid resolves the plugin used for logging in, and
+   * falls back to the site-wide active plugin.
+   *
+   * @param \Drupal\webform\WebformInterface|null $webform
+   *   The webform. If not set, the webform of the current request, if any, is
+   *   used.
+   *
+   * @return \Drupal\os2web_nemlogin\Plugin\AuthProviderInterface
+   *   The auth provider plugin.
+   *
+   * @throws \Drupal\Component\Plugin\Exception\PluginException
+   */
+  public function getAuthProviderPlugin(?WebformInterface $webform = NULL): AuthProviderInterface {
+    $webform ??= $this->webformRequest->getCurrentWebform();
+    $settings = $webform?->getThirdPartySetting('os2forms', 'os2forms_nemid');
+    $sessionType = $settings['session_type'] ?? NULL;
+
+    return !empty($sessionType)
+      ? $this->authProviderService->getPluginInstance($sessionType)
+      : $this->authProviderService->getActivePlugin();
   }
 
   /**
@@ -131,7 +167,7 @@ private function checkAccess(WebformSubmissionInterface $webformSubmission, stri
       $elementKey = $settings['element_key'];
       $userClaim = $settings['user_claim'];
 
-      $plugin = $this->authProviderService->getActivePlugin();
+      $plugin = $this->getAuthProviderPlugin($webform);
       if (!$plugin->isAuthenticated()) {
         return (string) $this->t('Not authenticated');
       }
@@ -163,7 +199,7 @@ public function webformThirdPartySettingsFormAlter(array &$form, FormStateInterf
     $webform = $formObject->getEntity();
     $settings = $webform->getThirdPartySetting('os2forms', 'os2forms_nemid');
 
-    $options = $this->getUserClaimOptions();
+    $options = $this->getUserClaimOptions($webform);
 
     $form['third_party_settings']['os2forms']['os2forms_nemid']['os2forms_nemlogin_openid_connect']['authentication_settings'] = [
       '#type' => 'fieldset',
@@ -216,16 +252,19 @@ public function webformThirdPartySettingsFormAlter(array &$form, FormStateInterf
   /**
    * Get user claim options.
    *
+   * @param \Drupal\webform\WebformInterface $webform
+   *   The webform.
+   *
    * @return array
    *   The user claim options.
    *
    * @phpstan-return array<string, mixed>
    */
-  private function getUserClaimOptions(): array {
-    $plugin = $this->authProviderService->getActivePlugin();
-    $claims = $plugin->getConfiguration()['nemlogin_openid_connect_user_claims'] ?? '';
-
+  private function getUserClaimOptions(WebformInterface $webform): array {
     try {
+      $plugin = $this->getAuthProviderPlugin($webform);
+      $claims = $plugin->getConfiguration()['nemlogin_openid_connect_user_claims'] ?? '';
+
       $value = Yaml::parse($claims);
       if (is_array($value)) {
         asort($value);