Disable password confirmation when using SSO (reverse proxy) authentication #982

New Issue

GiteaMirror · 2025-11-02T03:44:16-06:00

GiteaMirror commented

2025-11-02 03:44:16 -06:00

Originally created by @kuklinistvan on GitHub (Aug 20, 2017).

Gitea version (or commit ref):
Git version: 1.1.3
Operating system: Arch Linux
Database (use [x]):
- PostgreSQL
- MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes (provide example URL)
- No
- Not relevant
Log gist: (?)

Description

I've set up a Gitea instance and configured it to authenticate users against mod_auth_kerb with these options to provide SSO service:

REVERSE_PROXY_AUTHENTICATION_USER = X-WEBAUTH-USER
ENABLE_REVERSE_PROXY_AUTHENTICATION    = true
ENABLE_REVERSE_PROXY_AUTO_REGISTRATION = true

In apache vhosts configuration:

...
        RequestHeader set X-WEBAUTH-USER expr=%{REMOTE_USER}
...

Now, as expected, I cannot use any functions that require password confirmation as my Gitea instance is not prepared to be aware of using this external authentication source. A solution would be to disable password confirmation, I guess. (had a similar issue with NextCloud)

Screenshots

Originally created by @kuklinistvan on GitHub (Aug 20, 2017).  - Gitea version (or commit ref): - Git version: 1.1.3 - Operating system: Arch Linux - Database (use `[x]`): - [x] PostgreSQL - [ ] MySQL - [ ] MSSQL - [ ] SQLite - Can you reproduce the bug at https://try.gitea.io: - [ ] Yes (provide example URL) - [x] No - [x] Not relevant - Log gist: (?) ## Description I've set up a Gitea instance and configured it to authenticate users against `mod_auth_kerb` with these options to provide SSO service: ``` REVERSE_PROXY_AUTHENTICATION_USER = X-WEBAUTH-USER ENABLE_REVERSE_PROXY_AUTHENTICATION = true ENABLE_REVERSE_PROXY_AUTO_REGISTRATION = true ``` In apache vhosts configuration: ``` ... RequestHeader set X-WEBAUTH-USER expr=%{REMOTE_USER} ... ``` Now, as expected, I cannot use any functions that require password confirmation as my Gitea instance is not prepared to be aware of using this external authentication source. A solution would be to disable password confirmation, I guess. (had a similar issue with NextCloud) ## Screenshots ![Password confirmation](https://image.ibb.co/dBE2P5/K_perny_k_p_2017_08_20_13_31_16.png)

GiteaMirror added the issue/duplicate label 2025-11-02 03:44:16 -06:00

GiteaMirror closed this issue

2025-11-02 03:44:17 -06:00

GiteaMirror commented

2025-11-02 03:44:17 -06:00

@strk commented on GitHub (Aug 20, 2017):

Same problem exists when using other password-less authentication
means (OAuth2, OpenID).

If I'm not wrong there's an open issue about dealing with that

@strk commented on GitHub (Aug 20, 2017): Same problem exists when using other password-less authentication means (OAuth2, OpenID). If I'm not wrong there's an open issue about dealing with that

GiteaMirror commented

2025-11-02 03:44:17 -06:00

@strk commented on GitHub (Aug 20, 2017):

#1036 is the previous discussion ticket

@strk commented on GitHub (Aug 20, 2017): #1036 is the previous discussion ticket

GiteaMirror commented

2025-11-02 03:44:18 -06:00

@lafriks commented on GitHub (Aug 20, 2017):

Closing as duplicate for #1036

@lafriks commented on GitHub (Aug 20, 2017): Closing as duplicate for #1036

GiteaMirror referenced this issue

2025-11-02 11:52:32 -06:00