Exclude federation user from container principal auto-create

1 files changed, 10 insertions, 5 deletions

diff --git a/src/main/java/com/gitblit/GitBlit.java b/src/main/java/com/gitblit/GitBlit.java
index 1f9a9472..6285733b 100644
--- a/src/main/java/com/gitblit/GitBlit.java
+++ b/src/main/java/com/gitblit/GitBlit.java
@@ -749,10 +749,7 @@ public class GitBlit implements ServletContextListener {
 			if (usernameDecoded.equalsIgnoreCase(Constants.FEDERATION_USER)) {
 				List<String> tokens = getFederationTokens();
 				if (tokens.contains(pw)) {
-					// the federation user is an administrator
-					UserModel federationUser = new UserModel(Constants.FEDERATION_USER);
-					federationUser.canAdmin = true;
-					return federationUser;
+					return getFederationUser();
 				}
 			}
 		}
@@ -846,7 +843,8 @@ public class GitBlit implements ServletContextListener {
 					logger.debug(MessageFormat.format("{0} authenticated by servlet container principal from {1}",
 							user.username, httpRequest.getRemoteAddr()));
 					return user;
-				} else if (settings.getBoolean(Keys.realm.container.autoCreateAccounts, true)) {
+				} else if (settings.getBoolean(Keys.realm.container.autoCreateAccounts, false)
+						&& !username.equalsIgnoreCase(Constants.FEDERATION_USER)) {
 					// auto-create user from an authenticated container principal
 					user = new UserModel(username.toLowerCase());
 					user.displayName = username;
@@ -1025,6 +1023,13 @@ public class GitBlit implements ServletContextListener {
 		String usernameDecoded = decodeUsername(username);
 		return userService.deleteUser(usernameDecoded);
 	}
+	
+	protected UserModel getFederationUser() {
+		// the federation user is an administrator
+		UserModel federationUser = new UserModel(Constants.FEDERATION_USER);
+		federationUser.canAdmin = true;
+		return federationUser;
+	}
 
 	/**
 	 * Retrieve the user object for the specified username.