Update existing LDAP users without using sync #10408

New Issue

GiteaMirror · 2025-11-02T09:06:41-06:00

GiteaMirror commented

2025-11-02 09:06:41 -06:00

Originally created by @urz-hgw on GitHub (Mar 10, 2023).

Feature Description

Hi,

we are successfully running an LDAP as Authentication Source with Gitea. But we deactivated the 'User Synchronisation" since we have around 20K users in LDAP, which should all be able to login to Gitea, but only those accounts who actually want to use Gitea (around 100) should be existing there to fullfill the data economy for the GDPR.

This has the sad effect, that AFAIK the cron 'Synchronize external user data' does not update the existing LDAP users unless the 'User Synchronisation' of the LDAP source is activated - which also would add all other users, what we want to prevent.

Therefore it would be great, if the user data of LDAP users are updated every time an LDAP user logs in into Gitea.

Best regards
Daniel

Screenshots

No response

Originally created by @urz-hgw on GitHub (Mar 10, 2023). ### Feature Description Hi, we are successfully running an LDAP as Authentication Source with Gitea. But we deactivated the 'User Synchronisation" since we have around 20K users in LDAP, which should all be able to login to Gitea, but only those accounts who actually want to use Gitea (around 100) should be existing there to fullfill the data economy for the GDPR. This has the sad effect, that AFAIK the cron 'Synchronize external user data' does not update the existing LDAP users unless the 'User Synchronisation' of the LDAP source is activated - which also would add all other users, what we want to prevent. Therefore it would be great, if the user data of LDAP users are updated every time an LDAP user logs in into Gitea. Best regards Daniel ### Screenshots _No response_

GiteaMirror added the type/proposal topic/authentication type/feature labels 2025-11-02 09:06:41 -06:00

GiteaMirror commented

2025-11-02 09:06:41 -06:00

@raucao commented on GitHub (May 31, 2025):

I just ran into this issue and had to disable the sync task as well.

Another solution could be a new config for LDAP auth to only update existing users, but not create new ones during background sync tasks.

However, it's actually bad UX that when user data, like name or avatar, is updated on the LDAP account, and the user logs in to Gitea again before sync has run, they still see their old data, which might then be overwritten later. So I think every login should always update the user data from the directory, regardless of the auto-account-creation issue.

@raucao commented on GitHub (May 31, 2025): I just ran into this issue and had to disable the sync task as well. Another solution could be a new config for LDAP auth to only update existing users, but not create new ones during background sync tasks. However, it's actually bad UX that when user data, like name or avatar, is updated on the LDAP account, and the user logs in to Gitea again before sync has run, they still see their old data, which might then be overwritten later. So I think every login should always update the user data from the directory, regardless of the auto-account-creation issue.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#10408