gitea signin with keycloak linked to wrong user #1683

New Issue

2025-11-02T04:09:29-06:00

GiteaMirror commented

2025-11-02 04:09:29 -06:00

Originally created by @imacks on GitHub (Apr 8, 2018).

Gitea version (or commit ref): 1.4.0
Git version: git in alpine pkg repo (3.6)
Operating system: alpine 3.6 (as container in docker)
Database (use [x]):
- PostgreSQL
- MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes (provide example URL)
- No
- Not relevant
Log gist:

Description

I am using gitea with keycloak. I created the first admin user (local, say 'gitadmin') and then added Admin Panel > Authentications > Add new source. Authentication name = [my-keycloak-gitea]; OAuth2 provider = openid connect; client id = keycloak-gitea; client secret = [copy from keycloak]; autodiscovery url = https://[keycloak.mydomain]/auth/realms/[my-realm]/.well-known/openid-configuration

On keycloak side:

(select or create realm 'my-realm') and enter 'my-realm'
clients > create > client id = keycloak-gitea; protocol = openid-connect > save
clients > keycloak-gitea > enabled; access type = confidential; standard flow; direct access grant; valid redirect urls = https://<gitea.mydomain>/*; web origins=+;
3.1. credentials > authenticator = client id & secret; (copy secret to gitea 'client secret')
3.2 mappers > (remove from list or add using 'add builtin' so that list only contains) family name, locale, given name, email, username, email verified
3.3 scope > full scope allowed

now i create a user 'john' in keycloak 'my-realm'.

return to gitea and login:

sign in with openid connect
(redirected to keycloak) > username = john; password = ... > i am now signed in as 'gitadmin' instead of 'john'. it should be john.

just to clarify, my config here is aimed at a private setup with keycloak login. so, except perhaps for the first admin user, all other users can only sign in via keycloak. federated/social login options are already available in keycloak and i don't want them in my gitea setup.

Originally created by @imacks on GitHub (Apr 8, 2018). - Gitea version (or commit ref): 1.4.0 - Git version: git in alpine pkg repo (3.6) - Operating system: alpine 3.6 (as container in docker) - Database (use `[x]`): - [ ] PostgreSQL - [x] MySQL - [ ] MSSQL - [ ] SQLite - Can you reproduce the bug at https://try.gitea.io: - [ ] Yes (provide example URL) - [ ] No - [x] Not relevant - Log gist: ## Description I am using gitea with keycloak. I created the first admin user (local, say 'gitadmin') and then added `Admin Panel > Authentications > Add new source`. Authentication name = [my-keycloak-gitea]; OAuth2 provider = openid connect; client id = keycloak-gitea; client secret = [copy from keycloak]; autodiscovery url = https://[keycloak.mydomain]/auth/realms/[my-realm]/.well-known/openid-configuration On keycloak side: 1. (select or create realm 'my-realm') and enter 'my-realm' 2. clients > create > client id = keycloak-gitea; protocol = openid-connect > save 3. clients > keycloak-gitea > enabled; access type = confidential; standard flow; direct access grant; valid redirect urls = https://<gitea.mydomain>/*; web origins=+; 3.1. credentials > authenticator = client id & secret; (copy secret to gitea 'client secret') 3.2 mappers > (remove from list or add using 'add builtin' so that list only contains) family name, locale, given name, email, username, email verified 3.3 scope > full scope allowed now i create a user 'john' in keycloak 'my-realm'. return to gitea and login: 1. sign in with openid connect 2. (redirected to keycloak) > username = john; password = ... > i am now signed in as 'gitadmin' instead of 'john'. it should be john. just to clarify, my config here is aimed at a private setup with keycloak login. so, except perhaps for the first admin user, all other users can only sign in via keycloak. federated/social login options are already available in keycloak and i don't want them in my gitea setup.

GiteaMirror added the issue/stale label 2025-11-02 04:09:29 -06:00

GiteaMirror closed this issue

2025-11-02 04:09:30 -06:00

GiteaMirror commented

2025-11-02 04:09:30 -06:00

@imacks commented on GitHub (Apr 8, 2018):

i've found a workaround:

in gitea, sign in as default admin user.
your settings > external accounts > (remove all)
admin panel > users > create new account > authentication source = my-keycloak-gitea; Authentication Login Name; Username = [name of user in keycloak]; Email = [email of user in keycloak]
Do not add more user info. Logout now.
In a private tab, sign in as new user with open id connect.
You should be redirected to keycloak login. use the new user credentials and it should redirect back to gitea with a link external account page.
Enter password. You should now be signed in as the new user.

This doesn't feel very satisfying to me. Maybe I'm missing something here...maybe we should be looking at this architecture:

[ldap backend]
           |
 +-----+-------+
  |                      |
  v                     v
[gitea] --> [keycloak]

@imacks commented on GitHub (Apr 8, 2018): i've found a workaround: 1. in gitea, sign in as default admin user. 2. your settings > external accounts > (remove all) 3. admin panel > users > create new account > authentication source = my-keycloak-gitea; Authentication Login Name; Username = [name of user in keycloak]; Email = [email of user in keycloak] 4. Do not add more user info. Logout now. 5. In a private tab, sign in as new user with open id connect. 6. You should be redirected to keycloak login. use the new user credentials and it should redirect back to gitea with a link external account page. 7. Enter password. You should now be signed in as the new user. This doesn't feel very satisfying to me. Maybe I'm missing something here...maybe we should be looking at this architecture: ``` [ldap backend] | +-----+-------+ | | v v [gitea] --> [keycloak] ```

GiteaMirror commented

2025-11-02 04:09:30 -06:00

@stale[bot] commented on GitHub (Jan 29, 2019):

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

@stale[bot] commented on GitHub (Jan 29, 2019): This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

GiteaMirror commented

2025-11-02 04:09:30 -06:00

@stale[bot] commented on GitHub (Feb 18, 2019):

This issue has been automatically closed because of inactivity. You can re-open it if needed.

@stale[bot] commented on GitHub (Feb 18, 2019): This issue has been automatically closed because of inactivity. You can re-open it if needed.

GiteaMirror commented

2025-11-02 04:09:31 -06:00

@mcejp commented on GitHub (Mar 18, 2019):

Have you ever figured this out? I suspect a configuration issue, because i'm having the same problem with GitLab, using Keycloak as the OAuth provider.

@mcejp commented on GitHub (Mar 18, 2019): Have you ever figured this out? I suspect a configuration issue, because i'm having the same problem with GitLab, using Keycloak as the OAuth provider.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#1683