github-starred/gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-03-17 13:42:23 -05:00
Code Issues 2.6k Packages Projects Releases 100 Wiki Activity

Gitea asks for local user password even when connected through OpenID #1539

New Issue
Open
opened 2025-11-02 04:04:18 -06:00 by GiteaMirror · 11 comments
GiteaMirror commented 2025-11-02 04:04:18 -06:00
Owner
Copy Link

Originally created by @arrfab on GitHub (Feb 16, 2018).

  • Gitea version (or commit ref): 1.3.2
  • Git version:
  • Operating system: CentOS 7
  • Database (use [x]):
    • PostgreSQL
    • MySQL
    • MSSQL
    • SQLite
  • Can you reproduce the bug at https://try.gitea.io:
    • Yes (provide example URL)
    • No
    • Not relevant
  • Log gist:

Description

When registered and connected through OpenID, a user even with admin rights has to confirm some operations with his "local" password.
Problem is that $user doesn't know his local password, as he was authenticated/validated/registered through OpenID
There is no even possibility for the user to change his "local" password, as it asks for the actual one (that $user doesn't know, as auto-registered through openid)
It seems the only solution would be for $user to ask a reset of his "local" gitea password , but that defeats completely the SSO goal
...

Originally created by @arrfab on GitHub (Feb 16, 2018). - Gitea version (or commit ref): 1.3.2 - Git version: - Operating system: CentOS 7 - Database (use `[x]`): - [ ] PostgreSQL - [x] MySQL - [ ] MSSQL - [ ] SQLite - Can you reproduce the bug at https://try.gitea.io: - [x] Yes (provide example URL) - [ ] No - [ ] Not relevant - Log gist: ## Description When registered and connected through OpenID, a user even with admin rights has to confirm some operations with his "local" password. Problem is that $user doesn't know his local password, as he was authenticated/validated/registered through OpenID There is no even possibility for the user to change his "local" password, as it asks for the actual one (that $user doesn't know, as auto-registered through openid) It seems the only solution would be for $user to ask a reset of his "local" gitea password , but that defeats completely the SSO goal ...
GiteaMirror added the issue/confirmedtype/enhancement labels 2025-11-02 04:04:18 -06:00
GiteaMirror commented 2025-11-02 04:04:19 -06:00
Author
Owner
Copy Link

@rakshith-ravi commented on GitHub (May 24, 2018):

@arrfab I'm using gitea in my server and am planning to switch to OpenID. Is this still happening?

@rakshith-ravi commented on GitHub (May 24, 2018): @arrfab I'm using gitea in my server and am planning to switch to OpenID. Is this still happening?
GiteaMirror commented 2025-11-02 04:04:19 -06:00
Author
Owner
Copy Link

@stale[bot] commented on GitHub (Jan 25, 2019):

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

@stale[bot] commented on GitHub (Jan 25, 2019): This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.
GiteaMirror commented 2025-11-02 04:04:19 -06:00
Author
Owner
Copy Link

@lunny commented on GitHub (Jan 25, 2019):

I think this is designed. External user have to binding to a local user.

@lunny commented on GitHub (Jan 25, 2019): I think this is designed. External user have to binding to a local user.
GiteaMirror commented 2025-11-02 04:04:19 -06:00
Author
Owner
Copy Link

@arrfab commented on GitHub (Jan 25, 2019):

@lunny except that such user doesn't know his "local password" and so can't even change it (as he was automatically registered through OpenID - see bug description)

@arrfab commented on GitHub (Jan 25, 2019): @lunny except that such user doesn't know his "local password" and so can't even change it (as he was automatically registered through OpenID - see bug description)
GiteaMirror commented 2025-11-02 04:04:19 -06:00
Author
Owner
Copy Link

@strk commented on GitHub (Jan 27, 2019):

There should be an issue already filed about managing password-less
accounts. If I'm not wrong the only way out from OpenID when asked
for a password would be to use the "reset password" and rely on email
to get a chance to use a new password (but things could have been
changed since I last looked at this).

Try to find that "password less accounts" ticket as some design is
really useful to handle that.

@strk commented on GitHub (Jan 27, 2019): There should be an issue already filed about managing password-less accounts. If I'm not wrong the only way out from OpenID when asked for a password would be to use the "reset password" and rely on email to get a chance to use a new password (but things could have been changed since I last looked at this). Try to find that "password less accounts" ticket as some design is really useful to handle that.
GiteaMirror commented 2025-11-02 04:04:20 -06:00
Author
Owner
Copy Link

@stale[bot] commented on GitHub (Mar 28, 2019):

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

@stale[bot] commented on GitHub (Mar 28, 2019): This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.
GiteaMirror commented 2025-11-02 04:04:20 -06:00
Author
Owner
Copy Link

@lunny commented on GitHub (Mar 29, 2019):

A random password could be set when an external user login and user could change it when he need.

@lunny commented on GitHub (Mar 29, 2019): A random password could be set when an external user login and user could change it when he need.
GiteaMirror commented 2025-11-02 04:04:20 -06:00
Author
Owner
Copy Link

@strk commented on GitHub (Apr 4, 2019):

A random password could be set when an external user login and user could change it when he need.

This is what my initial implementation of the OpenID-2.0 authentication did. Was it changed recently ?

@strk commented on GitHub (Apr 4, 2019): > A random password could be set when an external user login and user could change it when he need. This is what my initial implementation of the OpenID-2.0 authentication did. Was it changed recently ?
GiteaMirror commented 2025-11-02 04:04:21 -06:00
Author
Owner
Copy Link

@strk commented on GitHub (Apr 4, 2019):

This is the issue I was talking about: https://github.com/go-gitea/gitea/issues/1036
The discussion should happen there

@strk commented on GitHub (Apr 4, 2019): This is the issue I was talking about: https://github.com/go-gitea/gitea/issues/1036 The discussion should happen there
GiteaMirror commented 2025-11-02 04:04:21 -06:00
Author
Owner
Copy Link

@stale[bot] commented on GitHub (Jun 3, 2019):

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

@stale[bot] commented on GitHub (Jun 3, 2019): This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.
GiteaMirror commented 2025-11-02 04:04:21 -06:00
Author
Owner
Copy Link

@MartinX3 commented on GitHub (Jun 3, 2019):

Please don't close this important issue.

@MartinX3 commented on GitHub (Jun 3, 2019): Please don't close this important issue.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
$20
$250
$50
$500
backport/done
💎 Bounty
docs-update-needed
good first issue
hacktoberfest
issue/bounty
issue/confirmed
issue/critical
issue/duplicate
issue/needs-feedback
issue/not-a-bug
issue/regression
issue/stale
issue/workaround
lgtm/need 2
modifies/api
modifies/translation
outdated/backport/v1.18
outdated/theme/markdown
outdated/theme/timetracker
performance/bigrepo
performance/cpu
performance/memory
performance/speed
pr/breaking
proposal/accepted
proposal/rejected
pr/wip
pull-request
Mirrored from GitHub Pull Request
 reviewed/wontfix
💰 Rewarded
skip-changelog
status/blocked
topic/accessibility
topic/api
topic/authentication
topic/build
topic/code-linting
topic/commit-signing
topic/content-rendering
topic/deployment
topic/distribution
topic/federation
topic/gitea-actions
topic/issues
topic/lfs
topic/mobile
topic/moderation
topic/packages
topic/pr
topic/projects
topic/repo
topic/repo-migration
topic/security
topic/theme
topic/ui
topic/ui-interaction
topic/ux
topic/webhooks
topic/wiki
type/bug
type/deprecation
type/docs
type/enhancement
type/feature
type/miscellaneous
type/proposal
type/question
type/refactoring
type/summary
type/testing
type/upstream
No Label issue/confirmed type/enhancement
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/gitea#1539
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?