From: James Moger <james.moger@gitblit.com>
Date: Fri, 28 Jun 2013 14:41:56 +0000 (-0400)
Subject: Exclude federation user from container principal auto-create
X-Git-Tag: v1.3.0~32
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=aa7d215a9a174428f4f76244b932797d9b87b910;p=gitblit.git

Exclude federation user from container principal auto-create
---

diff --git a/src/main/java/com/gitblit/GitBlit.java b/src/main/java/com/gitblit/GitBlit.java
index 1f9a9472..6285733b 100644
--- a/src/main/java/com/gitblit/GitBlit.java
+++ b/src/main/java/com/gitblit/GitBlit.java
@@ -749,10 +749,7 @@ public class GitBlit implements ServletContextListener {
 			if (usernameDecoded.equalsIgnoreCase(Constants.FEDERATION_USER)) {
 				List<String> tokens = getFederationTokens();
 				if (tokens.contains(pw)) {
-					// the federation user is an administrator
-					UserModel federationUser = new UserModel(Constants.FEDERATION_USER);
-					federationUser.canAdmin = true;
-					return federationUser;
+					return getFederationUser();
 				}
 			}
 		}
@@ -846,7 +843,8 @@ public class GitBlit implements ServletContextListener {
 					logger.debug(MessageFormat.format("{0} authenticated by servlet container principal from {1}",
 							user.username, httpRequest.getRemoteAddr()));
 					return user;
-				} else if (settings.getBoolean(Keys.realm.container.autoCreateAccounts, true)) {
+				} else if (settings.getBoolean(Keys.realm.container.autoCreateAccounts, false)
+						&& !username.equalsIgnoreCase(Constants.FEDERATION_USER)) {
 					// auto-create user from an authenticated container principal
 					user = new UserModel(username.toLowerCase());
 					user.displayName = username;
@@ -1025,6 +1023,13 @@ public class GitBlit implements ServletContextListener {
 		String usernameDecoded = decodeUsername(username);
 		return userService.deleteUser(usernameDecoded);
 	}
+	
+	protected UserModel getFederationUser() {
+		// the federation user is an administrator
+		UserModel federationUser = new UserModel(Constants.FEDERATION_USER);
+		federationUser.canAdmin = true;
+		return federationUser;
+	}
 
 	/**
 	 * Retrieve the user object for the specified username.