gitea

mirror of https://github.com/go-gitea/gitea.git synced 2026-06-18 00:43:38 +02:00

History

Lunny Xiao 6f5def0f37 fix(auth): ignore stale OIDC external login links to organizations (#37875 )

This fixes an OIDC sign-in edge case where a stale `external_login_user`
record can still point to an organization or a deleted user.

In that situation, Gitea may keep resolving the external login to the
wrong account during sign-in. For affected instances, this matches the
behavior reported in #36439 and #37812, where a user signing in with
OIDC/Entra ID could appear as an organization, or hit a 404 after that
organization was removed.

- validate the user resolved from `external_login_user` during
OAuth2/OIDC login
- ignore stale links when the linked user no longer exists
- ignore stale links when the linked user is not an individual user
- remove the stale external login row so the sign-in flow can relink the
external account to the correct user

- Fixes #37812
- Related to #36439

---------

Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Claude (Opus 4.8) <noreply@anthropic.com>

2026-06-16 19:21:00 -07:00

assert_interface_test.go

Enforce two-factor auth (2FA: TOTP or WebAuthn) (#34187 )

2025-04-28 15:31:59 -07:00

init.go

Fix oauth2 session gob register (#36017 )

2025-11-26 23:25:34 +08:00

main_test.go

allow synchronizing user status from OAuth2 login providers (#31572 )

2024-07-16 20:33:16 +02:00

providers_base.go

Redirect to the only OAuth2 provider when no other login methods and fix various problems (#36901 )