Skip to content

Commit def13ec

Browse files
wxiaoguangwxiaoguang
authored
Allow to disable the password-based login (sign-in) form (#32687)
Usually enterprise/organization users would like to only allow OAuth2 login. This PR adds a new config option to disable the password-based login form. It is a simple and clear approach and won't block the future login-system refactoring works. Fix a TODO in #24821 Replace #21851 Close #7633 , close #13606
1 parent 1bb1a51 commit def13ec

File tree

7 files changed

+73
-48
lines changed

7 files changed

+73
-48
lines changed

‎custom/conf/app.example.ini

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -784,6 +784,10 @@ LEVEL = Info
784784
;; Please note that setting this to false will not disable OAuth Basic or Basic authentication using a token
785785
;ENABLE_BASIC_AUTHENTICATION = true
786786
;;
787+
;; Show the password sign-in form (for password-based login), otherwise, only show OAuth2 login methods.
788+
;; If you set it to false, maybe it also needs to set ENABLE_BASIC_AUTHENTICATION to false to completely disable password-based authentication.
789+
;ENABLE_PASSWORD_SIGNIN_FORM = true
790+
;;
787791
;; More detail: https://github.com/gogits/gogs/issues/165
788792
;ENABLE_REVERSE_PROXY_AUTHENTICATION = false
789793
; Enable this to allow reverse proxy authentication for API requests, the reverse proxy is responsible for ensuring that no CSRF is possible.
@@ -1944,13 +1948,13 @@ LEVEL = Info
19441948
;; Minio secretAccessKey to connect only available when STORAGE_TYPE is `minio`
19451949
;MINIO_SECRET_ACCESS_KEY =
19461950
;;
1947-
;; Preferred IAM Endpoint to override Minio's default IAM Endpoint resolution only available when STORAGE_TYPE is `minio`.
1948-
;; If not provided and STORAGE_TYPE is `minio`, will search for and derive endpoint from known environment variables
1949-
;; (AWS_CONTAINER_AUTHORIZATION_TOKEN, AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE, AWS_CONTAINER_CREDENTIALS_RELATIVE_URI,
1950-
;; AWS_CONTAINER_CREDENTIALS_FULL_URI, AWS_WEB_IDENTITY_TOKEN_FILE, AWS_ROLE_ARN, AWS_ROLE_SESSION_NAME, AWS_REGION),
1951+
;; Preferred IAM Endpoint to override Minio's default IAM Endpoint resolution only available when STORAGE_TYPE is `minio`.
1952+
;; If not provided and STORAGE_TYPE is `minio`, will search for and derive endpoint from known environment variables
1953+
;; (AWS_CONTAINER_AUTHORIZATION_TOKEN, AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE, AWS_CONTAINER_CREDENTIALS_RELATIVE_URI,
1954+
;; AWS_CONTAINER_CREDENTIALS_FULL_URI, AWS_WEB_IDENTITY_TOKEN_FILE, AWS_ROLE_ARN, AWS_ROLE_SESSION_NAME, AWS_REGION),
19511955
;; or the DefaultIAMRoleEndpoint if not provided otherwise.
19521956
;MINIO_IAM_ENDPOINT =
1953-
;;
1957+
;;
19541958
;; Minio bucket to store the attachments only available when STORAGE_TYPE is `minio`
19551959
;MINIO_BUCKET = gitea
19561960
;;
@@ -2695,10 +2699,10 @@ LEVEL = Info
26952699
;; Minio secretAccessKey to connect only available when STORAGE_TYPE is `minio`
26962700
;MINIO_SECRET_ACCESS_KEY =
26972701
;;
2698-
;; Preferred IAM Endpoint to override Minio's default IAM Endpoint resolution only available when STORAGE_TYPE is `minio`.
2699-
;; If not provided and STORAGE_TYPE is `minio`, will search for and derive endpoint from known environment variables
2700-
;; (AWS_CONTAINER_AUTHORIZATION_TOKEN, AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE, AWS_CONTAINER_CREDENTIALS_RELATIVE_URI,
2701-
;; AWS_CONTAINER_CREDENTIALS_FULL_URI, AWS_WEB_IDENTITY_TOKEN_FILE, AWS_ROLE_ARN, AWS_ROLE_SESSION_NAME, AWS_REGION),
2702+
;; Preferred IAM Endpoint to override Minio's default IAM Endpoint resolution only available when STORAGE_TYPE is `minio`.
2703+
;; If not provided and STORAGE_TYPE is `minio`, will search for and derive endpoint from known environment variables
2704+
;; (AWS_CONTAINER_AUTHORIZATION_TOKEN, AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE, AWS_CONTAINER_CREDENTIALS_RELATIVE_URI,
2705+
;; AWS_CONTAINER_CREDENTIALS_FULL_URI, AWS_WEB_IDENTITY_TOKEN_FILE, AWS_ROLE_ARN, AWS_ROLE_SESSION_NAME, AWS_REGION),
27022706
;; or the DefaultIAMRoleEndpoint if not provided otherwise.
27032707
;MINIO_IAM_ENDPOINT =
27042708
;;

‎modules/setting/service.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@ var Service = struct {
4141
AllowOnlyInternalRegistration bool
4242
AllowOnlyExternalRegistration bool
4343
ShowRegistrationButton bool
44+
EnablePasswordSignInForm bool
4445
ShowMilestonesDashboardPage bool
4546
RequireSignInView bool
4647
EnableNotifyMail bool
@@ -159,6 +160,7 @@ func loadServiceFrom(rootCfg ConfigProvider) {
159160
Service.ShowMilestonesDashboardPage = sec.Key("SHOW_MILESTONES_DASHBOARD_PAGE").MustBool(true)
160161
Service.RequireSignInView = sec.Key("REQUIRE_SIGNIN_VIEW").MustBool()
161162
Service.EnableBasicAuth = sec.Key("ENABLE_BASIC_AUTHENTICATION").MustBool(true)
163+
Service.EnablePasswordSignInForm = sec.Key("ENABLE_PASSWORD_SIGNIN_FORM").MustBool(true)
162164
Service.EnableReverseProxyAuth = sec.Key("ENABLE_REVERSE_PROXY_AUTHENTICATION").MustBool()
163165
Service.EnableReverseProxyAuthAPI = sec.Key("ENABLE_REVERSE_PROXY_AUTHENTICATION_API").MustBool()
164166
Service.EnableReverseProxyAutoRegister = sec.Key("ENABLE_REVERSE_PROXY_AUTO_REGISTRATION").MustBool()

‎routers/web/auth/auth.go

Lines changed: 17 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -160,54 +160,42 @@ func CheckAutoLogin(ctx *context.Context) bool {
160160
return false
161161
}
162162

163-
// SignIn render sign in page
164-
func SignIn(ctx *context.Context) {
163+
func prepareSignInPageData(ctx *context.Context) {
165164
ctx.Data["Title"] = ctx.Tr("sign_in")
166-
167-
if CheckAutoLogin(ctx) {
168-
return
169-
}
170-
171-
if ctx.IsSigned {
172-
RedirectAfterLogin(ctx)
173-
return
174-
}
175-
176-
oauth2Providers, err := oauth2.GetOAuth2Providers(ctx, optional.Some(true))
177-
if err != nil {
178-
ctx.ServerError("UserSignIn", err)
179-
return
180-
}
181-
ctx.Data["OAuth2Providers"] = oauth2Providers
165+
ctx.Data["OAuth2Providers"], _ = oauth2.GetOAuth2Providers(ctx, optional.Some(true))
182166
ctx.Data["Title"] = ctx.Tr("sign_in")
183167
ctx.Data["SignInLink"] = setting.AppSubURL + "/user/login"
184168
ctx.Data["PageIsSignIn"] = true
185169
ctx.Data["PageIsLogin"] = true
186170
ctx.Data["EnableSSPI"] = auth.IsSSPIEnabled(ctx)
171+
ctx.Data["EnablePasswordSignInForm"] = setting.Service.EnablePasswordSignInForm
187172

188173
if setting.Service.EnableCaptcha && setting.Service.RequireCaptchaForLogin {
189174
context.SetCaptchaData(ctx)
190175
}
176+
}
191177

178+
// SignIn render sign in page
179+
func SignIn(ctx *context.Context) {
180+
if CheckAutoLogin(ctx) {
181+
return
182+
}
183+
if ctx.IsSigned {
184+
RedirectAfterLogin(ctx)
185+
return
186+
}
187+
prepareSignInPageData(ctx)
192188
ctx.HTML(http.StatusOK, tplSignIn)
193189
}
194190

195191
// SignInPost response for sign in request
196192
func SignInPost(ctx *context.Context) {
197-
ctx.Data["Title"] = ctx.Tr("sign_in")
198-
199-
oauth2Providers, err := oauth2.GetOAuth2Providers(ctx, optional.Some(true))
200-
if err != nil {
201-
ctx.ServerError("UserSignIn", err)
193+
if !setting.Service.EnablePasswordSignInForm {
194+
ctx.Error(http.StatusForbidden)
202195
return
203196
}
204-
ctx.Data["OAuth2Providers"] = oauth2Providers
205-
ctx.Data["Title"] = ctx.Tr("sign_in")
206-
ctx.Data["SignInLink"] = setting.AppSubURL + "/user/login"
207-
ctx.Data["PageIsSignIn"] = true
208-
ctx.Data["PageIsLogin"] = true
209-
ctx.Data["EnableSSPI"] = auth.IsSSPIEnabled(ctx)
210197

198+
prepareSignInPageData(ctx)
211199
if ctx.HasError() {
212200
ctx.HTML(http.StatusOK, tplSignIn)
213201
return
@@ -216,8 +204,6 @@ func SignInPost(ctx *context.Context) {
216204
form := web.GetForm(ctx).(*forms.SignInForm)
217205

218206
if setting.Service.EnableCaptcha && setting.Service.RequireCaptchaForLogin {
219-
context.SetCaptchaData(ctx)
220-
221207
context.VerifyCaptcha(ctx, tplSignIn, form)
222208
if ctx.Written() {
223209
return

‎templates/user/auth/oauth_container.tmpl

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,3 @@
1-
{{if or .OAuth2Providers .EnableOpenIDSignIn}}
2-
<div class="divider divider-text">
3-
{{ctx.Locale.Tr "sign_in_or"}}
4-
</div>
51
<div id="oauth2-login-navigator" class="tw-py-1">
62
<div class="tw-flex tw-flex-col tw-justify-center">
73
<div id="oauth2-login-navigator-inner" class="tw-flex tw-flex-col tw-flex-wrap tw-items-center tw-gap-2">
@@ -26,4 +22,3 @@
2622
</div>
2723
</div>
2824
</div>
29-
{{end}}

‎templates/user/auth/signin_inner.tmpl

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
{{end}}
1111
</h4>
1212
<div class="ui attached segment">
13+
{{if .EnablePasswordSignInForm}}
1314
<form class="ui form" action="{{.SignInLink}}" method="post">
1415
{{.CsrfTokenHtml}}
1516
<div class="required field {{if and (.Err_UserName) (or (not .LinkAccountMode) (and .LinkAccountMode .LinkAccountModeSignIn))}}error{{end}}">
@@ -46,8 +47,13 @@
4647
</button>
4748
</div>
4849
</form>
49-
50-
{{template "user/auth/oauth_container" .}}
50+
{{end}}{{/*if .EnablePasswordSignInForm*/}}
51+
{{if and .OAuth2Providers .EnableOpenIDSignIn .EnablePasswordSignInForm}}
52+
<div class="divider divider-text">{{ctx.Locale.Tr "sign_in_or"}}</div>
53+
{{end}}
54+
{{if and .OAuth2Providers .EnableOpenIDSignIn}}
55+
{{template "user/auth/oauth_container" .}}
56+
{{end}}
5157
</div>
5258
</div>
5359

‎templates/user/auth/signup_inner.tmpl

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,10 @@
4848
</div>
4949
{{end}}
5050

51-
{{template "user/auth/oauth_container" .}}
51+
{{if and .OAuth2Providers .EnableOpenIDSignIn}}
52+
<div class="divider divider-text">{{ctx.Locale.Tr "sign_in_or"}}</div>
53+
{{template "user/auth/oauth_container" .}}
54+
{{end}}
5255
</form>
5356
</div>
5457
</div>

‎tests/integration/signin_test.go

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ import (
1212
"code.gitea.io/gitea/models/unittest"
1313
user_model "code.gitea.io/gitea/models/user"
1414
"code.gitea.io/gitea/modules/setting"
15+
"code.gitea.io/gitea/modules/test"
1516
"code.gitea.io/gitea/modules/translation"
1617
"code.gitea.io/gitea/tests"
1718

@@ -91,3 +92,31 @@ func TestSigninWithRememberMe(t *testing.T) {
9192
req = NewRequest(t, "GET", "/user/settings")
9293
session.MakeRequest(t, req, http.StatusOK)
9394
}
95+
96+
func TestEnablePasswordSignInForm(t *testing.T) {
97+
defer tests.PrepareTestEnv(t)()
98+
99+
t.Run("EnablePasswordSignInForm=false", func(t *testing.T) {
100+
defer tests.PrintCurrentTest(t)()
101+
defer test.MockVariableValue(&setting.Service.EnablePasswordSignInForm, false)()
102+
103+
req := NewRequest(t, "GET", "/user/login")
104+
resp := MakeRequest(t, req, http.StatusOK)
105+
NewHTMLParser(t, resp.Body).AssertElement(t, "form[action='/user/login']", false)
106+
107+
req = NewRequest(t, "POST", "/user/login")
108+
MakeRequest(t, req, http.StatusForbidden)
109+
})
110+
111+
t.Run("EnablePasswordSignInForm=true", func(t *testing.T) {
112+
defer tests.PrintCurrentTest(t)()
113+
defer test.MockVariableValue(&setting.Service.EnablePasswordSignInForm, true)()
114+
115+
req := NewRequest(t, "GET", "/user/login")
116+
resp := MakeRequest(t, req, http.StatusOK)
117+
NewHTMLParser(t, resp.Body).AssertElement(t, "form[action='/user/login']", true)
118+
119+
req = NewRequest(t, "POST", "/user/login")
120+
MakeRequest(t, req, http.StatusOK)
121+
})
122+
}

0 commit comments

Comments
 (0)