github-starred/vikunja
2
0
Fork 0
mirror of https://github.com/go-vikunja/vikunja.git synced 2026-08-24 11:43:50 -05:00
Code Issues 690 Packages Projects Releases 13 Wiki Activity

[GH-ISSUE #2624] enableuserregistration: false does not prevent openid registration #6716

New Issue
Closed
opened 2026-04-20 17:17:48 -05:00 by GiteaMirror · 2 comments
GiteaMirror commented 2026-04-20 17:17:48 -05:00
Owner
Copy Link
Copy Source

Originally created by @axos88 on GitHub (Apr 14, 2026).
Original GitHub issue: https://github.com/go-vikunja/vikunja/issues/2624

Pre-submission checklist

  • I have searched for existing open or closed issue reports with the same problem.

Description

Repro:

  • set service/enableregistration: false
  • add an openid auth method, such as google oauth2.0
  • disable local login (although probably not necessary
  • open the app, and log in via google

Expected:

  • login fails, unless the user already exists in the db

Actual:

  • user is created, confirmed via docker exec -it vikunja /app/vikunja/vikunja user list

Vikunja Version

latest

Browser and version

n/a

Can you reproduce the bug on the Vikunja demo site?

No

Screenshots

No response

Originally created by @axos88 on GitHub (Apr 14, 2026). Original GitHub issue: https://github.com/go-vikunja/vikunja/issues/2624 ### Pre-submission checklist - [x] I have searched for existing open or closed issue reports with the same problem. ### Description Repro: - set service/enableregistration: false - add an openid auth method, such as google oauth2.0 - disable local login (although probably not necessary - open the app, and log in via google Expected: - login fails, unless the user already exists in the db Actual: - user is created, confirmed via `docker exec -it vikunja /app/vikunja/vikunja user list` ### Vikunja Version latest ### Browser and version n/a ### Can you reproduce the bug on the Vikunja demo site? No ### Screenshots _No response_
GiteaMirror added the concern/regressionarea/autharea/config labels 2026-04-20 17:17:48 -05:00
GiteaMirror commented 2026-04-20 17:17:52 -05:00
Author
Owner
Copy Link
Copy Source

@kolaente commented on GitHub (Apr 15, 2026):

This is out of scope. As the admin, you're responsible for ensuring that the openid provider only allows users that you want to have an account on Vikunja.

<!-- gh-comment-id:4250663954 --> @kolaente commented on GitHub (Apr 15, 2026): This is out of scope. As the admin, you're responsible for ensuring that the openid provider only allows users that you want to have an account on Vikunja.
GiteaMirror commented 2026-04-20 17:17:53 -05:00
Author
Owner
Copy Link
Copy Source

@axos88 commented on GitHub (Apr 17, 2026):

I understand the suggested workaround, but it doesn’t address the core issue.
service.enableregistration=false is not enforced consistently. It works for local auth, but is effectively ignored for OpenID since users are auto-created on first login.
OpenID Connect is for authentication (authn) — it tells Vikunja who the user is.
Whether that user is allowed to have an account is authorization (authz), which is the application’s responsibility.
Right now that authz decision is bypassed for OpenID users, and account creation is implicitly allowed.
This shifts control entirely to the IdP, which isn’t always practical (e.g. Google), and removes the ability to disable self-service account creation at the application level.
There’s currently no way to:
disable registration
use OpenID
and prevent new users from being created
That’s the gap this issue is pointing out.

<!-- gh-comment-id:4267660609 --> @axos88 commented on GitHub (Apr 17, 2026): I understand the suggested workaround, but it doesn’t address the core issue. service.enableregistration=false is not enforced consistently. It works for local auth, but is effectively ignored for OpenID since users are auto-created on first login. OpenID Connect is for authentication (authn) — it tells Vikunja who the user is. Whether that user is allowed to have an account is authorization (authz), which is the application’s responsibility. Right now that authz decision is bypassed for OpenID users, and account creation is implicitly allowed. This shifts control entirely to the IdP, which isn’t always practical (e.g. Google), and removes the ability to disable self-service account creation at the application level. There’s currently no way to: disable registration use OpenID and prevent new users from being created That’s the gap this issue is pointing out.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/api
area/attachments
area/auth
area/avatars
area/backup-restore
area/caldav
area/calendar-view
area/comments
area/config
area/database
area/desktop
area/docker
area/email
area/favorites
area/filters
area/frontend
area/gantt
area/i18n
area/import-export
area/internal-code
area/kanban
area/labels
area/list-view
area/mobile
area/notifications
area/permissions
area/projects
area/pwa
area/recurring-tasks
area/reminders
area/search
area/shortcuts
area/subtasks
area/sync
area/table-view
area/task-editor
area/task-metadata
area/task-relations
area/teams
area/theming
area/time-tracking
area/typesense
area/views
area/webhooks
bug
changes requested
concern/accessibility
concern/performance
concern/regression
concern/ux
confirmed
db/mysql
dependencies
enhancement
good first issue
help wanted
integration/inbound
integration/outbound
kind/bug
kind/feature
needs reproduction
pull-request
Mirrored from GitHub Pull Request
 pull-request
Mirrored from GitHub Pull Request
 pull-request
Mirrored from GitHub Pull Request
 question
security
support
upstream issue
waiting for reply
wontfix
No labels area/auth area/config concern/regression
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/vikunja#6716