Exclude federation user from container principal auto-create

diff --git a/src/main/java/com/gitblit/GitBlit.java b/src/main/java/com/gitblit/GitBlit.java
index 1f9a9472d957896d78187d3b659a84f216b549f5..6285733bde11e52606b09717a6cc03894d3c23da 100644 (file)
--- a/src/main/java/com/gitblit/GitBlit.java
+++ b/src/main/java/com/gitblit/GitBlit.java
@@ -749,10 +749,7 @@ public class GitBlit implements ServletContextListener {
                        if (usernameDecoded.equalsIgnoreCase(Constants.FEDERATION_USER)) {
                                List<String> tokens = getFederationTokens();
                                if (tokens.contains(pw)) {
-                                       // the federation user is an administrator
-                                       UserModel federationUser = new UserModel(Constants.FEDERATION_USER);
-                                       federationUser.canAdmin = true;
-                                       return federationUser;
+                                       return getFederationUser();
                                }
                        }
                }
@@ -846,7 +843,8 @@ public class GitBlit implements ServletContextListener {
                                        logger.debug(MessageFormat.format("{0} authenticated by servlet container principal from {1}",
                                                        user.username, httpRequest.getRemoteAddr()));
                                        return user;
-                               } else if (settings.getBoolean(Keys.realm.container.autoCreateAccounts, true)) {
+                               } else if (settings.getBoolean(Keys.realm.container.autoCreateAccounts, false)
+                                               && !username.equalsIgnoreCase(Constants.FEDERATION_USER)) {
                                        // auto-create user from an authenticated container principal
                                        user = new UserModel(username.toLowerCase());
                                        user.displayName = username;
@@ -1025,6 +1023,13 @@ public class GitBlit implements ServletContextListener {
                String usernameDecoded = decodeUsername(username);
                return userService.deleteUser(usernameDecoded);
        }
+       
+       protected UserModel getFederationUser() {
+               // the federation user is an administrator
+               UserModel federationUser = new UserModel(Constants.FEDERATION_USER);
+               federationUser.canAdmin = true;
+               return federationUser;
+       }
 
        /**
         * Retrieve the user object for the specified username.