LDAP allow disable auto register users #1443

New Issue

GiteaMirror · 2025-11-02T04:01:01-06:00

GiteaMirror commented

2025-11-02 04:01:01 -06:00

Originally created by @manuelluis on GitHub (Jan 12, 2018).

Gitea version (or commit ref): 1.3.2
Git version: 2.9
Operating system: RHEL7
Database (use [x]):
- PostgreSQL
- MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes (provide example URL)
- No
- Not relevant
Log gist:

Description

Currently you cannot disable the auto registration for users that are validated through LDAP. I like to manually create the users and validate against LDAP but disable the auto creation.

In commit cd37fccdfb the option for disable auto registration of users in LDAP was removed. This commit was discussed in gogs issue: LDAP authentication not allowing users to login https://github.com/gogits/gogs/issues/1625

This problem was discussed before in this gogs issue: LDAP auto register toggle: https://github.com/gogits/gogs/issues/3179

Is it ok to do a pull request to enable this option again?

Originally created by @manuelluis on GitHub (Jan 12, 2018). - Gitea version (or commit ref): 1.3.2 - Git version: 2.9 - Operating system: RHEL7 - Database (use `[x]`): - [ ] PostgreSQL - [x] MySQL - [ ] MSSQL - [ ] SQLite - Can you reproduce the bug at https://try.gitea.io: - [ ] Yes (provide example URL) - [ ] No - [x] Not relevant - Log gist: ## Description Currently you cannot disable the auto registration for users that are validated through LDAP. I like to manually create the users and validate against LDAP but disable the auto creation. In commit https://github.com/go-gitea/gitea/commit/cd37fccdfbdf5a1a5b2d85263ffb219068d19205 the option for disable auto registration of users in LDAP was removed. This commit was discussed in gogs issue: LDAP authentication not allowing users to login https://github.com/gogits/gogs/issues/1625 This problem was discussed before in this gogs issue: LDAP auto register toggle: https://github.com/gogits/gogs/issues/3179 Is it ok to do a pull request to enable this option again?

GiteaMirror added the type/feature issue/confirmed topic/authentication labels 2025-11-02 04:01:01 -06:00

GiteaMirror commented

2025-11-02 04:01:01 -06:00

@lafriks commented on GitHub (Jan 12, 2018):

What is use case for this? There is no way to manually create users for LDAP auth source.

@lafriks commented on GitHub (Jan 12, 2018): What is use case for this? There is no way to manually create users for LDAP auth source.

GiteaMirror commented

2025-11-02 04:01:02 -06:00

@manuelluis commented on GitHub (Jan 12, 2018):

The use case is: if you cannot filter the users in the LDAP Authentication using the search base or user filter you cannot limit your users.

I just want to use the LDAP Authentication to check the password not to limit the users that have access.

When I create an user I can select the Authentication Source:

Users -> Create New Account -> Authentication Source, In authentication Source select the LDAP Authentication created in Authentications.

@manuelluis commented on GitHub (Jan 12, 2018): The use case is: if you cannot filter the users in the LDAP Authentication using the search base or user filter you cannot limit your users. I just want to use the LDAP Authentication to check the password not to limit the users that have access. When I create an user I can select the Authentication Source: Users -> Create New Account -> Authentication Source, In authentication Source select the LDAP Authentication created in Authentications.

GiteaMirror commented

2025-11-02 04:01:02 -06:00

@lafriks commented on GitHub (Jan 12, 2018):

Ok, you can create users manually, I take my words back :)

Most correct way would be limit users by group, isn't that option for you?

@lafriks commented on GitHub (Jan 12, 2018): Ok, you can create users manually, I take my words back :) Most correct way would be limit users by group, isn't that option for you?

GiteaMirror commented

2025-11-02 04:01:02 -06:00

@manuelluis commented on GitHub (Jan 12, 2018):

Yes, the most correct way is limiting the search base or filter users by groups, but I have some limitations for creating and manager the users in the LDAP.
It's easy for me create users manually that authenticate to LDAP in gitea, only use LDAP for authentication.

@manuelluis commented on GitHub (Jan 12, 2018): Yes, the most correct way is limiting the search base or filter users by groups, but I have some limitations for creating and manager the users in the LDAP. It's easy for me create users manually that authenticate to LDAP in gitea, only use LDAP for authentication.

GiteaMirror commented

2025-11-02 04:01:02 -06:00

@lafriks commented on GitHub (Jan 12, 2018):

But this feature would need to be added back a bit differently as it was before as now also ldap sync must be updated to check for that. Anyway feel free to submit PR. Also when authorizing user has to see correct reason for not being able to authorize because of disabled user registration

@lafriks commented on GitHub (Jan 12, 2018): But this feature would need to be added back a bit differently as it was before as now also ldap sync must be updated to check for that. Anyway feel free to submit PR. Also when authorizing user has to see correct reason for not being able to authorize because of disabled user registration

GiteaMirror commented

2025-11-02 04:01:02 -06:00

@manuelluis commented on GitHub (Jan 12, 2018):

I had not noticed that the sync not only update users also create user all users that found in LDAP.

It's not working for me because there is to many users:

[...gitea/models/user.go:1393 SyncExternalUsers()] [E] LDAP Search failed unexpectedly! (LDAP Result Code 4 "Size Limit Exceeded": )

@manuelluis commented on GitHub (Jan 12, 2018): I had not noticed that the sync not only update users also create user all users that found in LDAP. It's not working for me because there is to many users: [...gitea/models/user.go:1393 SyncExternalUsers()] [E] LDAP Search failed unexpectedly! (LDAP Result Code 4 "Size Limit Exceeded": )

GiteaMirror commented

2025-11-02 04:01:03 -06:00

@strk commented on GitHub (Jan 12, 2018):

[...gitea/models/user.go:1393 SyncExternalUsers()] [E] LDAP Search failed unexpectedly! (LDAP Result Code 4 "Size Limit Exceeded": )

Interesting, do you know what such "Size Limit" is ?

@strk commented on GitHub (Jan 12, 2018): > [...gitea/models/user.go:1393 SyncExternalUsers()] [E] LDAP Search failed unexpectedly! (LDAP Result Code 4 "Size Limit Exceeded": ) Interesting, do you know what such "Size Limit" is ?

GiteaMirror commented

2025-11-02 04:01:03 -06:00

@manuelluis commented on GitHub (Jan 12, 2018):

The LDAP is Active Directory, it has a configurable maximun number of returned results, by default it's 1000.

The function SearchWithPaging should get all the users of the AD, paginating the result.

@manuelluis commented on GitHub (Jan 12, 2018): The LDAP is Active Directory, it has a configurable maximun number of returned results, by default it's 1000. The function [SearchWithPaging](https://gowalker.org/gopkg.in/go-ldap/ldap.v2#Conn_SearchWithPaging) should get all the users of the AD, paginating the result.

GiteaMirror commented

2025-11-02 04:01:03 -06:00

@lafriks commented on GitHub (Jan 12, 2018):

Yeah, pagination is not yet implemented but it's on my to-do list :)

@lafriks commented on GitHub (Jan 12, 2018): Yeah, pagination is not yet implemented but it's on my to-do list :)

GiteaMirror commented

2025-11-02 04:01:03 -06:00

@stale[bot] commented on GitHub (Feb 9, 2019):

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

@stale[bot] commented on GitHub (Feb 9, 2019): This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

GiteaMirror commented

2025-11-02 04:01:04 -06:00

@lafriks commented on GitHub (Feb 9, 2019):

@manuelluis paging has been already implemented

@lafriks commented on GitHub (Feb 9, 2019): @manuelluis paging has been already implemented

GiteaMirror commented

2025-11-02 04:01:04 -06:00

@Lantizia commented on GitHub (Apr 26, 2023):

Going back to what @manuelluis originally raised...

Currently you cannot disable the auto registration for users that are validated through LDAP. I like to manually create the users and validate against LDAP but disable the auto creation.

Yes, this would be super useful still.

There aren't always times when you can make dedicated groups to limit which users can log in... and even if you do have that ability... there can be other reasons where you'd prefer to pre-create Gitea users (of the same login name that you have on AD) prior to a users first LDAP login, usually to pre-tailor one or more attributes which couldn't be learnt from AD (or perhaps would be messed up by it).

Ultimately having the choice of just doing a password check only for existing users... is a useful feature to reintroduce for greater flexibility. It's an option on most other web based apps I've used like MediaWiki, phpIPAM, moodle, etc...

@Lantizia commented on GitHub (Apr 26, 2023): Going back to what @manuelluis originally raised... > Currently you cannot disable the auto registration for users that are validated through LDAP. I like to manually create the users and validate against LDAP but disable the auto creation. Yes, this would be super useful still. There aren't always times when you can make dedicated groups to limit which users can log in... and even if you do have that ability... there can be other reasons where you'd prefer to pre-create Gitea users (of the same login name that you have on AD) prior to a users first LDAP login, usually to pre-tailor one or more attributes which couldn't be learnt from AD (or perhaps would be messed up by it). Ultimately having the choice of just doing a password check only for existing users... is a useful feature to reintroduce for greater flexibility. It's an option on most other web based apps I've used like MediaWiki, phpIPAM, moodle, etc...

GiteaMirror referenced this issue

2025-11-02 11:57:33 -06:00

[PR #1448] [MERGED] fix migrate failed and org dashboard failed on MSSQL database #15909

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#1443