ACCOUNT_LINKING depends on ENABLE_AUTO_REGISTRATION

[mgx0]

Description

our goal is to create a Gitea user and link it to Keycloak credentials, all of this via Gitea REST API. in version 1.18 it was possible by setting Authentication Source to an int (that corresponded to Keycloak auth source ID), but in version 1.20.2 we have to set ACCOUNT_LINKING to "auto".

but without setting ENABLE_AUTO_REGISTRATION to "true" it does not work. Setting ENABLE_AUTO_REGISTRATION=true enables anyone to register at our Gitea instance, which is not what we want (we allow no self-registration).

goal is to have ACCOUNT_LINKING="auto" causing linking Gitea account to Keycloak account without having to set ENABLE_AUTO_REGISTRATION=true

is this possible?

Gitea Version

1.20.2

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

container in kubernetes

Database

PostgreSQL

[dianaStr7]

Hi! Yes, having same problem out there. Users with keycloack account can auto-register all by themselves and occupy a license.

[mgx0]

Hi! Yes, having same problem out there. Users with keycloack account can auto-register all by themselves and occupy a license.

even without a keycloak account

[joneshf]

Looks like the logic was first added in #5123. In particular, the check for ENABLE_AUTO_REGISTRATION was added in this commit: a473815 (it was originally called ENABLE_OAUTH2_AUTO_REGISTRATION in that commit), and handling ACCOUNT_LINKING was added in this commit: 3edad74 (it was originally split between two the booleans ENABLE_AUTO_REGISTRATION_LINKING and SHOW_ACCOUNT_LINKING_LOGIN in that commit).

Looks like a discussion happened starting on this comment: #5123 (comment). But nothing specific about allowing ACCOUNT_LINKING separate from ENABLE_AUTO_REGISTRATION. My guess from reading the conversation is that this case was not left out intentionally. Rather, it just wasn't discussed.

Assuming that's mostly right, it looks like adding a new case to the checks here:

gitea/routers/web/auth/oauth.go

Lines 133 to 210 in a739c78

	if ctx.Doer != nil {
	// attach user to the current signed-in user
	err = externalaccount.LinkAccountToUser(ctx, ctx.Doer, gothUser)
	if err != nil {
	ctx.ServerError("UserLinkAccount", err)
	return
	}
	ctx.Redirect(setting.AppSubURL + "/user/settings/security")
	return
	} else if !setting.Service.AllowOnlyInternalRegistration && setting.OAuth2Client.EnableAutoRegistration {
	// create new user with details from oauth2 provider
	var missingFields []string
	if gothUser.UserID == "" {
	missingFields = append(missingFields, "sub")
	}
	if gothUser.Email == "" {
	missingFields = append(missingFields, "email")
	}
	uname, err := extractUserNameFromOAuth2(&gothUser)
	if err != nil {
	ctx.ServerError("UserSignIn", err)
	return
	}
	if uname == "" {
	if setting.OAuth2Client.Username == setting.OAuth2UsernameNickname {
	missingFields = append(missingFields, "nickname")
	} else if setting.OAuth2Client.Username == setting.OAuth2UsernamePreferredUsername {
	missingFields = append(missingFields, "preferred_username")
	} // else: "UserID" and "Email" have been handled above separately
	}
	if len(missingFields) > 0 {
	log.Error(`OAuth2 auto registration (ENABLE_AUTO_REGISTRATION) is enabled but OAuth2 provider %q doesn't return required fields: %s. `+
	`Suggest to: disable auto registration, or make OPENID_CONNECT_SCOPES (for OpenIDConnect) / Authentication Source Scopes (for Admin panel) to request all required fields, and the fields shouldn't be empty.`,
	authSource.Name, strings.Join(missingFields, ","))
	// The RawData is the only way to pass the missing fields to the another page at the moment, other ways all have various problems:
	// by session or cookie: difficult to clean or reset; by URL: could be injected with uncontrollable content; by ctx.Flash: the link_account page is a mess ...
	// Since the RawData is for the provider's data, so we need to use our own prefix here to avoid conflict.
	if gothUser.RawData == nil {
	gothUser.RawData = make(map[string]any)
	}
	gothUser.RawData["__giteaAutoRegMissingFields"] = missingFields
	showLinkingLogin(ctx, gothUser)
	return
	}
	u = &user_model.User{
	Name: uname,
	FullName: gothUser.Name,
	Email: gothUser.Email,
	LoginType: auth.OAuth2,
	LoginSource: authSource.ID,
	LoginName: gothUser.UserID,
	}
	overwriteDefault := &user_model.CreateUserOverwriteOptions{
	IsActive: optional.Some(!setting.OAuth2Client.RegisterEmailConfirm && !setting.Service.RegisterManualConfirm),
	}
	source := authSource.Cfg.(*oauth2.Source)
	isAdmin, isRestricted := getUserAdminAndRestrictedFromGroupClaims(source, &gothUser)
	u.IsAdmin = isAdmin.ValueOrDefault(false)
	u.IsRestricted = isRestricted.ValueOrDefault(false)
	if !createAndHandleCreatedUser(ctx, templates.TplName(""), nil, u, overwriteDefault, &gothUser, setting.OAuth2Client.AccountLinking != setting.OAuth2AccountLinkingDisabled) {
	// error already handled
	return
	}
	if err := syncGroupsToTeams(ctx, source, &gothUser, u); err != nil {
	ctx.ServerError("SyncGroupsToTeams", err)
	return
	}
	} else {
	// no existing user is found, request attach or new account
	showLinkingLogin(ctx, gothUser)
	return
	}

(like else if setting.OAuth2Client.AccountLinking == setting.OAuth2AccountLinkingAuto { before the else) and calling something similar to this code:

gitea/routers/web/auth/auth.go

Lines 535 to 556 in a739c78

	if allowLink && (user_model.IsErrUserAlreadyExist(err) || user_model.IsErrEmailAlreadyUsed(err)) {
	if setting.OAuth2Client.AccountLinking == setting.OAuth2AccountLinkingAuto {
	var user *user_model.User
	user = &user_model.User{Name: u.Name}
	hasUser, err := user_model.GetUser(ctx, user)
	if !hasUser || err != nil {
	user = &user_model.User{Email: u.Email}
	hasUser, err = user_model.GetUser(ctx, user)
	if !hasUser || err != nil {
	ctx.ServerError("UserLinkAccount", err)
	return false
	}
	}
	// TODO: probably we should respect 'remember' user's choice...
	linkAccount(ctx, user, *gothUser, true)
	return false // user is already created here, all redirects are handled
	} else if setting.OAuth2Client.AccountLinking == setting.OAuth2AccountLinkingLogin {
	showLinkingLogin(ctx, *gothUser)
	return false // user will be created only after linking login
	}
	}

(or extracting it and calling it in both places) would be what would be necessary to make ACCOUNT_LINKING work without also requiring ENABLE_AUTO_REGISTRATION to be enabled.

[zacuke]

I'm trying to get Account_Linking= auto to work without also turning on enable_auto_registration.

My use case: I add the email on my Gitea instance and I want it to auto link when the user signs in the first time.

But I want my Gitea instance to remain private, so unknown emails are blocked.