Gitea deactivates user every day #1831

Closed
opened 2025-11-02 04:14:33 -06:00 by GiteaMirror · 15 comments
Owner

Originally created by @ghtyrant on GitHub (May 28, 2018).

  • Gitea version (or commit ref): 1.4.1 built with: bindata, sqlite
  • Git version: 2.11.0
  • Operating system: Debian 9.4
  • Database (use [x]):
    • PostgreSQL
    • MySQL
    • MSSQL
    • SQLite
  • Can you reproduce the bug at https://try.gitea.io:
    • Yes (provide example URL)
    • No
    • Not relevant
  • Log gist:

Description

Every day at 10:15, gitea deactivates my user. I have to navigate to the web interface (where I'm still logged in and have administrative permissions) and manually reactivate myself, otherwise I can't push to repositories. All I see in log files are the following queries being run in xorm.log:

root@git:/var/lib/gitea/log# grep -rn "UPDATE \"user"
xorm.log.2018-05-23.001:69:2018/05/22 10:15:56 [I] [SQL] UPDATE "user" SET "is_active" = $1, "updated_unix" = $2 WHERE "id"=$3 []interface {}{false, 1526976956, 3}
xorm.log.2018-05-28.001:111:2018/05/27 10:15:56 [I] [SQL] UPDATE "user" SET "is_active" = $1, "updated_unix" = $2 WHERE "id"=$3 []interface {}{false, 1527408956, 3}
xorm.log.2018-05-22.001:82:2018/05/21 10:15:56 [I] [SQL] UPDATE "user" SET "is_active" = $1, "updated_unix" = $2 WHERE "id"=$3 []interface {}{false, 1526890556, 3}
xorm.log.2018-05-27.001:69:2018/05/26 10:15:56 [I] [SQL] UPDATE "user" SET "is_active" = $1, "updated_unix" = $2 WHERE "id"=$3 []interface {}{false, 1527322556, 3}
xorm.log.2018-05-26.001:73:2018/05/25 10:15:56 [I] [SQL] UPDATE "user" SET "is_active" = $1, "updated_unix" = $2 WHERE "id"=$3 []interface {}{false, 1527236156, 3}
xorm.log.2018-05-25.001:69:2018/05/24 10:15:56 [I] [SQL] UPDATE "user" SET "is_active" = $1, "updated_unix" = $2 WHERE "id"=$3 []interface {}{false, 1527149756, 3}
xorm.log.2018-05-24.001:69:2018/05/23 10:15:56 [I] [SQL] UPDATE "user" SET "is_active" = $1, "updated_unix" = $2 WHERE "id"=$3 []interface {}{false, 1527063356, 3}

The other log files contain nothing that would suggest what is going on. I'm using LDAP authentication (Bind DN).

Originally created by @ghtyrant on GitHub (May 28, 2018). <!-- 1. Please speak English, this is the language all of us can speak and write. 2. Please ask questions or configuration/deploy problems on our Discord server (https://discord.gg/NsatcWJ) or forum (https://discourse.gitea.io). 3. Please take a moment to check that your issue doesn't already exist. 4. Please give all relevant information below for bug reports, because incomplete details will be handled as an invalid report. --> - Gitea version (or commit ref): 1.4.1 built with: bindata, sqlite - Git version: 2.11.0 - Operating system: Debian 9.4 - Database (use `[x]`): - [x] PostgreSQL - [ ] MySQL - [ ] MSSQL - [ ] SQLite - Can you reproduce the bug at https://try.gitea.io: - [ ] Yes (provide example URL) - [ ] No - [x] Not relevant - Log gist: ## Description Every day at 10:15, gitea deactivates my user. I have to navigate to the web interface (where I'm still logged in and have administrative permissions) and manually reactivate myself, otherwise I can't push to repositories. All I see in log files are the following queries being run in xorm.log: ``` root@git:/var/lib/gitea/log# grep -rn "UPDATE \"user" xorm.log.2018-05-23.001:69:2018/05/22 10:15:56 [I] [SQL] UPDATE "user" SET "is_active" = $1, "updated_unix" = $2 WHERE "id"=$3 []interface {}{false, 1526976956, 3} xorm.log.2018-05-28.001:111:2018/05/27 10:15:56 [I] [SQL] UPDATE "user" SET "is_active" = $1, "updated_unix" = $2 WHERE "id"=$3 []interface {}{false, 1527408956, 3} xorm.log.2018-05-22.001:82:2018/05/21 10:15:56 [I] [SQL] UPDATE "user" SET "is_active" = $1, "updated_unix" = $2 WHERE "id"=$3 []interface {}{false, 1526890556, 3} xorm.log.2018-05-27.001:69:2018/05/26 10:15:56 [I] [SQL] UPDATE "user" SET "is_active" = $1, "updated_unix" = $2 WHERE "id"=$3 []interface {}{false, 1527322556, 3} xorm.log.2018-05-26.001:73:2018/05/25 10:15:56 [I] [SQL] UPDATE "user" SET "is_active" = $1, "updated_unix" = $2 WHERE "id"=$3 []interface {}{false, 1527236156, 3} xorm.log.2018-05-25.001:69:2018/05/24 10:15:56 [I] [SQL] UPDATE "user" SET "is_active" = $1, "updated_unix" = $2 WHERE "id"=$3 []interface {}{false, 1527149756, 3} xorm.log.2018-05-24.001:69:2018/05/23 10:15:56 [I] [SQL] UPDATE "user" SET "is_active" = $1, "updated_unix" = $2 WHERE "id"=$3 []interface {}{false, 1527063356, 3} ``` The other log files contain nothing that would suggest what is going on. I'm using LDAP authentication (Bind DN).
GiteaMirror added the issue/staletype/docsissue/needs-feedbacktype/bug labels 2025-11-02 04:14:33 -06:00
Author
Owner

@harryxu commented on GitHub (May 28, 2018):

I have same issue.

And my solution is set UPDATE_EXISTING = false in cron.sync_external_users

/home/git/gitea/custom/conf/app.ini

; Synchronize external user data (only LDAP user synchronization is supported)
[cron.sync_external_users]
; Synchronize external user data when starting server (default false)
RUN_AT_START = false
SCHEDULE = @every 24h
UPDATE_EXISTING = false
@harryxu commented on GitHub (May 28, 2018): I have same issue. And my solution is set `UPDATE_EXISTING = false` in `cron.sync_external_users` `/home/git/gitea/custom/conf/app.ini` ```ini ; Synchronize external user data (only LDAP user synchronization is supported) [cron.sync_external_users] ; Synchronize external user data when starting server (default false) RUN_AT_START = false SCHEDULE = @every 24h UPDATE_EXISTING = false ```
Author
Owner

@ghtyrant commented on GitHub (May 28, 2018):

Thanks for this workaround! edit: Just confirming that it worked for me, thanks again.

I will leave this issue open as I believe this to be something that needs fixing.

@ghtyrant commented on GitHub (May 28, 2018): Thanks for this workaround! **edit:** Just confirming that it worked for me, thanks again. I will leave this issue open as I believe this to be something that needs fixing.
Author
Owner

@yamss commented on GitHub (Jun 7, 2018):

Hello harryxu, im using docker to host my gitea... how can I change this setting? All my accounts are getting deactivated every day.

@yamss commented on GitHub (Jun 7, 2018): Hello harryxu, im using docker to host my gitea... how can I change this setting? All my accounts are getting deactivated every day.
Author
Owner

@lafriks commented on GitHub (Jun 7, 2018):

Please specify your LDAP source configuration & LDAP server software being used

@lafriks commented on GitHub (Jun 7, 2018): Please specify your LDAP source configuration & LDAP server software being used
Author
Owner

@yamss commented on GitHub (Jun 7, 2018):

  • Gitea version (or commit ref): Docker 1.4.2
  • Git version: n/a
  • Operating system: CentOS 7
  • Database (use [x]):
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite

Using MS Active Directory:

User Filter= (sAMAccountName=%s)
Admin Filter= (&(objectCategory=Person)(memberOf=CN=GU_TSC,OU=Grupos,DC=lc,DC=gc,DC=local))

@yamss commented on GitHub (Jun 7, 2018): - Gitea version (or commit ref): Docker 1.4.2 - Git version: n/a - Operating system: CentOS 7 - Database (use [x]): - [ ] PostgreSQL - [x] MySQL - [ ] MSSQL - [ ] SQLite Using MS Active Directory: User Filter= (sAMAccountName=%s) Admin Filter= (&(objectCategory=Person)(memberOf=CN=GU_TSC,OU=Grupos,DC=lc,DC=gc,DC=local))
Author
Owner

@harryxu commented on GitHub (Jun 7, 2018):

@yamss https://docs.gitea.io/en-us/install-with-docker/#customization

May be you can mount your custom folder to docker container?

@harryxu commented on GitHub (Jun 7, 2018): @yamss https://docs.gitea.io/en-us/install-with-docker/#customization May be you can mount your custom folder to docker container?
Author
Owner

@ghtyrant commented on GitHub (Jun 7, 2018):

@lafriks

Ah, while checking my configuration I think I found the culprit: I've skipped the Admin Filter.
Never mind, it's been a long day for me.

LDAP (via BindDN), Unencrypted.
Bind DN: cn=gitea,ou=users,dc=mydomain,dc=tld
Search Base: ou=users,dc=mydomain,dc=tld
User Filter: (&(cn=%s)(memberOf=cn=git,ou=groups,dc=mydomain,dc=tld))

I'm using OpenLDAP (slapd) 2.4.44+dfsg-5+deb9u1

@ghtyrant commented on GitHub (Jun 7, 2018): @lafriks ~Ah, while checking my configuration I think I found the culprit: I've skipped the Admin Filter.~ Never mind, it's been a long day for me. LDAP (via BindDN), Unencrypted. Bind DN: cn=gitea,ou=users,dc=_mydomain_,dc=_tld_ Search Base: ou=users,dc=_mydomain_,dc=_tld_ User Filter: (&(cn=%s)(memberOf=cn=git,ou=groups,dc=_mydomain_,dc=_tld_)) I'm using OpenLDAP (slapd) 2.4.44+dfsg-5+deb9u1
Author
Owner

@ghtyrant commented on GitHub (Jun 7, 2018):

Looks like I got it to work by setting "cn" (username, in my case) as value of "Username attribute" - it was empty before.

Logs before this change:

2018/06/07 21:00:03 [T] Doing: SyncExternalUsers
2018/06/07 21:00:03 [T] Doing: SyncExternalUsers[LDAP]
2018/06/07 21:00:03 [T] Dialing LDAP with security protocol (0) without verifying: false
2018/06/07 21:00:03 [T] Bound as BindDN cn=gitea,ou=users,dc=mydomain,dc=tld
2018/06/07 21:00:03 [T] Fetching attributes '', '', '', 'mail' with filter (&(cn=*)(memberOf=cn=git,ou=groups,dc=mydomain,dc=tld)) and base ou=users,dc=mydomain,dc=tld
2018/06/07 21:00:03 [T] Checking admin with filter (&(memberOf=cn=git,ou=groups,dc=mydomain,dc=tld)(memberOf=cn=admin,ou=groups,dc=mydomain,dc=tld)) and base cn=myuser,ou=users,dc=mydomain,dc=tld
2018/06/07 21:00:03 [T] SyncExternalUsers[LDAP]: Deactivating user myuser

Logs after this change:

2018/06/07 21:02:03 [T] Doing: SyncExternalUsers
2018/06/07 21:02:03 [T] Doing: SyncExternalUsers[LDAP]
2018/06/07 21:02:03 [T] Dialing LDAP with security protocol (0) without verifying: false
2018/06/07 21:02:03 [T] Bound as BindDN cn=gitea,ou=users,dc=mydomain,dc=tld
2018/06/07 21:02:03 [T] Fetching attributes 'cn', 'givenName', '', 'mail' with filter (&(cn=*)(memberOf=cn=git,ou=groups,dc=mydomain,dc=tld)) and base ou=users,dc=mydomain,dc=tld
2018/06/07 21:02:03 [T] Checking admin with filter (&(memberOf=cn=git,ou=groups,dc=mydomain,dc=tld)(memberOf=cn=admin,ou=groups,dc=mydomain,dc=tld)) and base cn=myuser,ou=users,dc=mydomain,dc=tld
2018/06/07 21:02:03 [T] SyncExternalUsers[LDAP]: Updating user myuser
@ghtyrant commented on GitHub (Jun 7, 2018): Looks like I got it to work by setting "cn" (username, in my case) as value of "Username attribute" - it was empty before. Logs before this change: ``` 2018/06/07 21:00:03 [T] Doing: SyncExternalUsers 2018/06/07 21:00:03 [T] Doing: SyncExternalUsers[LDAP] 2018/06/07 21:00:03 [T] Dialing LDAP with security protocol (0) without verifying: false 2018/06/07 21:00:03 [T] Bound as BindDN cn=gitea,ou=users,dc=mydomain,dc=tld 2018/06/07 21:00:03 [T] Fetching attributes '', '', '', 'mail' with filter (&(cn=*)(memberOf=cn=git,ou=groups,dc=mydomain,dc=tld)) and base ou=users,dc=mydomain,dc=tld 2018/06/07 21:00:03 [T] Checking admin with filter (&(memberOf=cn=git,ou=groups,dc=mydomain,dc=tld)(memberOf=cn=admin,ou=groups,dc=mydomain,dc=tld)) and base cn=myuser,ou=users,dc=mydomain,dc=tld 2018/06/07 21:00:03 [T] SyncExternalUsers[LDAP]: Deactivating user myuser ``` Logs after this change: ``` 2018/06/07 21:02:03 [T] Doing: SyncExternalUsers 2018/06/07 21:02:03 [T] Doing: SyncExternalUsers[LDAP] 2018/06/07 21:02:03 [T] Dialing LDAP with security protocol (0) without verifying: false 2018/06/07 21:02:03 [T] Bound as BindDN cn=gitea,ou=users,dc=mydomain,dc=tld 2018/06/07 21:02:03 [T] Fetching attributes 'cn', 'givenName', '', 'mail' with filter (&(cn=*)(memberOf=cn=git,ou=groups,dc=mydomain,dc=tld)) and base ou=users,dc=mydomain,dc=tld 2018/06/07 21:02:03 [T] Checking admin with filter (&(memberOf=cn=git,ou=groups,dc=mydomain,dc=tld)(memberOf=cn=admin,ou=groups,dc=mydomain,dc=tld)) and base cn=myuser,ou=users,dc=mydomain,dc=tld 2018/06/07 21:02:03 [T] SyncExternalUsers[LDAP]: Updating user myuser ```
Author
Owner

@yamss commented on GitHub (Jun 7, 2018):

@harryxu added the parameters for the app.ini file in /var/lib/docker/volumes/gitea_data/_data/gitea/conf and restarted the docker, but that didn't work.

Setting 'cn' in "Username attribute" as described by @ghtyrant also didn't work for me.

@yamss commented on GitHub (Jun 7, 2018): @harryxu added the parameters for the app.ini file in /var/lib/docker/volumes/gitea_data/_data/gitea/conf and restarted the docker, but that didn't work. Setting 'cn' in "Username attribute" as described by @ghtyrant also didn't work for me.
Author
Owner

@henryk commented on GitHub (Jun 7, 2018):

@ghtyrant I had the same problem (well, different parameter names and values, OpenLDAP) and indeed, setting the "Username attribute" field fixed the problem. So, I'll call this a documentation problem. The documentation makes it seem that it's safe to leave the username attribute field empty, because it would just do the right thing then.

@henryk commented on GitHub (Jun 7, 2018): @ghtyrant I had the same problem (well, different parameter names and values, OpenLDAP) and indeed, setting the "Username attribute" field fixed the problem. So, I'll call this a documentation problem. The documentation makes it seem that it's safe to leave the username attribute field empty, because it would just do the right thing then.
Author
Owner
@daviian commented on GitHub (Aug 22, 2018): Related to: https://github.com/go-gitea/gitea/issues/4689, https://github.com/go-gitea/gitea/issues/3815, https://github.com/go-gitea/gitea/issues/4402 and https://github.com/go-gitea/gitea/issues/4433
Author
Owner

@liquidat commented on GitHub (Oct 9, 2018):

@ghtyrant That fixed it for me! Thanks so much!
For future reference: the proper attribute seems to depend on your actual configuration. In my case I had to enter "uid".

@liquidat commented on GitHub (Oct 9, 2018): @ghtyrant That fixed it for me! Thanks so much! For future reference: the proper attribute seems to depend on your actual configuration. In my case I had to enter "uid".
Author
Owner

@LarrysGIT commented on GitHub (Oct 24, 2018):

Looks like I got it to work by setting "cn" (username, in my case) as value of "Username attribute" - it was empty before.

Logs before this change:

2018/06/07 21:00:03 [T] Doing: SyncExternalUsers
2018/06/07 21:00:03 [T] Doing: SyncExternalUsers[LDAP]
2018/06/07 21:00:03 [T] Dialing LDAP with security protocol (0) without verifying: false
2018/06/07 21:00:03 [T] Bound as BindDN cn=gitea,ou=users,dc=mydomain,dc=tld
2018/06/07 21:00:03 [T] Fetching attributes '', '', '', 'mail' with filter (&(cn=*)(memberOf=cn=git,ou=groups,dc=mydomain,dc=tld)) and base ou=users,dc=mydomain,dc=tld
2018/06/07 21:00:03 [T] Checking admin with filter (&(memberOf=cn=git,ou=groups,dc=mydomain,dc=tld)(memberOf=cn=admin,ou=groups,dc=mydomain,dc=tld)) and base cn=myuser,ou=users,dc=mydomain,dc=tld
2018/06/07 21:00:03 [T] SyncExternalUsers[LDAP]: Deactivating user myuser

Logs after this change:

2018/06/07 21:02:03 [T] Doing: SyncExternalUsers
2018/06/07 21:02:03 [T] Doing: SyncExternalUsers[LDAP]
2018/06/07 21:02:03 [T] Dialing LDAP with security protocol (0) without verifying: false
2018/06/07 21:02:03 [T] Bound as BindDN cn=gitea,ou=users,dc=mydomain,dc=tld
2018/06/07 21:02:03 [T] Fetching attributes 'cn', 'givenName', '', 'mail' with filter (&(cn=*)(memberOf=cn=git,ou=groups,dc=mydomain,dc=tld)) and base ou=users,dc=mydomain,dc=tld
2018/06/07 21:02:03 [T] Checking admin with filter (&(memberOf=cn=git,ou=groups,dc=mydomain,dc=tld)(memberOf=cn=admin,ou=groups,dc=mydomain,dc=tld)) and base cn=myuser,ou=users,dc=mydomain,dc=tld
2018/06/07 21:02:03 [T] SyncExternalUsers[LDAP]: Updating user myuser

This is the right answer, change "Username Attribute" to "cn" makes it working, but but but, there is new trouble coming later because gitea seems to like "sAMAccountName" equals "cn", if they 2 attribute values not equal each other, there is trouble.

update,

my final configs following, start working now
case sensitive, be careful

image

@LarrysGIT commented on GitHub (Oct 24, 2018): > Looks like I got it to work by setting "cn" (username, in my case) as value of "Username attribute" - it was empty before. > > Logs before this change: > > ``` > 2018/06/07 21:00:03 [T] Doing: SyncExternalUsers > 2018/06/07 21:00:03 [T] Doing: SyncExternalUsers[LDAP] > 2018/06/07 21:00:03 [T] Dialing LDAP with security protocol (0) without verifying: false > 2018/06/07 21:00:03 [T] Bound as BindDN cn=gitea,ou=users,dc=mydomain,dc=tld > 2018/06/07 21:00:03 [T] Fetching attributes '', '', '', 'mail' with filter (&(cn=*)(memberOf=cn=git,ou=groups,dc=mydomain,dc=tld)) and base ou=users,dc=mydomain,dc=tld > 2018/06/07 21:00:03 [T] Checking admin with filter (&(memberOf=cn=git,ou=groups,dc=mydomain,dc=tld)(memberOf=cn=admin,ou=groups,dc=mydomain,dc=tld)) and base cn=myuser,ou=users,dc=mydomain,dc=tld > 2018/06/07 21:00:03 [T] SyncExternalUsers[LDAP]: Deactivating user myuser > ``` > Logs after this change: > > ``` > 2018/06/07 21:02:03 [T] Doing: SyncExternalUsers > 2018/06/07 21:02:03 [T] Doing: SyncExternalUsers[LDAP] > 2018/06/07 21:02:03 [T] Dialing LDAP with security protocol (0) without verifying: false > 2018/06/07 21:02:03 [T] Bound as BindDN cn=gitea,ou=users,dc=mydomain,dc=tld > 2018/06/07 21:02:03 [T] Fetching attributes 'cn', 'givenName', '', 'mail' with filter (&(cn=*)(memberOf=cn=git,ou=groups,dc=mydomain,dc=tld)) and base ou=users,dc=mydomain,dc=tld > 2018/06/07 21:02:03 [T] Checking admin with filter (&(memberOf=cn=git,ou=groups,dc=mydomain,dc=tld)(memberOf=cn=admin,ou=groups,dc=mydomain,dc=tld)) and base cn=myuser,ou=users,dc=mydomain,dc=tld > 2018/06/07 21:02:03 [T] SyncExternalUsers[LDAP]: Updating user myuser > ``` This is the right answer, change "Username Attribute" to "cn" makes it working, but but but, there is new trouble coming later because gitea seems to like "sAMAccountName" equals "cn", if they 2 attribute values not equal each other, there is trouble. update, my final configs following, start working now case sensitive, be careful ![image](https://user-images.githubusercontent.com/7692156/47401809-7f8bdb00-d78e-11e8-992b-1dc3c2847667.png)
Author
Owner

@stale[bot] commented on GitHub (Jan 6, 2019):

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

@stale[bot] commented on GitHub (Jan 6, 2019): This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.
Author
Owner

@stale[bot] commented on GitHub (Feb 23, 2019):

This issue has been automatically closed because of inactivity. You can re-open it if needed.

@stale[bot] commented on GitHub (Feb 23, 2019): This issue has been automatically closed because of inactivity. You can re-open it if needed.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/gitea#1831