aboutsummaryrefslogtreecommitdiffstats
path: root/services/auth/source
Commit message (Collapse)AuthorAgeFilesLines
* Refactor OpenIDConnect to support SSH/FullName sync (#34978)wxiaoguang2 days4-0/+15
| | | | | * Fix #26585 * Fix #28327 * Fix #34932
* Enable gocritic `equalFold` and fix issues (#34952)silverwind6 days1-1/+1
| | | | | | | Continuation of https://github.com/go-gitea/gitea/pull/34678. --------- Signed-off-by: silverwind <me@silverwind.io>
* enforce explanation for necessary nolints and fix bugs (#34883)TheFox0x72025-06-271-2/+2
| | | | | | | Follows up https://github.com/go-gitea/gitea/pull/34851 --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Run `gopls modernize` on codebase (#34751)silverwind2025-06-181-5/+5
| | | | Recent modernize fixes: https://github.com/golang/tools/commits/master/gopls/internal/analysis/modernize
* Fix last admin check when syncing users (#34649)wxiaoguang2025-06-092-2/+2
| | | Fix #34358
* Fix/improve avatar sync from LDAP (#34573)Râu Cao2025-06-021-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | This fixes 3 issues I encountered when debugging problems with our LDAP sync: 1. The comparison of the hashed image data in `IsUploadAvatarChanged` is wrong. It seems to be from before avatar hashing was changed and unified in #22289. This results in the function always returning `true` for any avatars, even if they weren't changed. 2. Even if there's no avatar to upload (i.e. no avatar available for the LDAP entry), the upload function would still be called for every single user, only to then fail, because the data isn't valid. This is unnecessary. 3. Another small issue is that the comparison function (and thus hashing of data) is called for every user, even if there is no avatar attribute configured at all for the LDAP source. Thus, I switched the condition nesting, so that no cycles are wasted when avatar sync isn't configured in the first place. I also added a trace log for when there is actually a new avatar being uploaded for an existing user, which is now only shown when that is actually the case. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Enforce two-factor auth (2FA: TOTP or WebAuthn) (#34187)wxiaoguang2025-04-2818-104/+63
| | | | | | | | | | | | | | | | | | | | | Fix #880 Design: 1. A global setting `security.TWO_FACTOR_AUTH`. * To support org-level config, we need to introduce a better "owner setting" system first (in the future) 2. A user without 2FA can login and may explore, but can NOT read or write to any repositories via API/web. 3. Keep things as simple as possible. * This option only aggressively suggest users to enable their 2FA at the moment, it does NOT guarantee that users must have 2FA before all other operations, it should be good enough for real world use cases. * Some details and tests could be improved in the future since this change only adds a check and seems won't affect too much. --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Enable addtional linters (#34085)TheFox0x72025-04-012-4/+2
| | | | | | | | enable mirror, usestdlibbars and perfsprint part of: https://github.com/go-gitea/gitea/issues/34083 --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Enable testifylint rules (#34075)TheFox0x72025-03-311-2/+2
| | | | enable testifylint rules disabled in: https://github.com/go-gitea/gitea/pull/34054
* Use test context in tests and new loop system in benchmarks (#33648)TheFox0x72025-02-201-9/+8
| | | | | | | | Replace all contexts in tests with go1.24 t.Context() --------- Co-authored-by: Giteabot <teabot@gitea.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Fix various trivial problems (#32861)wxiaoguang2024-12-171-0/+6
| | | | | | | | | | | | | | 1. add/improve comments to help future readers could understand the problem more easily. 2. add an error log to LDAP with username fallback 3. use `or` instead of `Iif` for "repo/branch_dropdown" (`Iif` was a mistake, but it doesn't really affect the UI) 4. add `tw-font-mono` style to container digest to match dockerhub 5. fix a bug in RepoBranchTagSelector: the form is not updated when there is no click to an item --------- Co-authored-by: delvh <dev.lh@web.de>
* Refactor some LDAP code (#32849)wxiaoguang2024-12-155-34/+42
|
* Enable tenv and testifylint rules (#32852)TheFox0x72024-12-151-4/+4
| | | | Enables tenv and testifylint linters closes: https://github.com/go-gitea/gitea/issues/32842
* Move team related functions to service layer (#32537)Lunny Xiao2024-11-271-3/+3
| | | | | There are still some functions under `models` after last big refactor about `models`. This change will move all team related functions to service layer with no code change.
* Update go dependencies (#32389)wxiaoguang2024-10-311-2/+2
|
* Make oauth2 code clear. Move oauth2 provider code to their own ↵Lunny Xiao2024-10-023-508/+0
| | | | | | packages/files (#32148) Fix #30266 Replace #31533
* Save initial signup information for users to aid in spam prevention (#31852)techknowlogick2024-09-095-5/+5
| | | | | | | | | | | | | | This will allow instance admins to view signup pattern patterns for public instances. It is modelled after discourse, mastodon, and MediaWiki's approaches. Note: This has privacy implications, but as the above-stated open-source projects take this approach, especially MediaWiki, which I have no doubt looked into this thoroughly, it is likely okay for us, too. However, I would be appreciative of any feedback on how this could be improved. --------- Co-authored-by: Giteabot <teabot@gitea.io>
* allow synchronizing user status from OAuth2 login providers (#31572)Rowan Bohde2024-07-165-1/+291
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This leverages the existing `sync_external_users` cron job to synchronize the `IsActive` flag on users who use an OAuth2 provider set to synchronize. This synchronization is done by checking for expired access tokens, and using the stored refresh token to request a new access token. If the response back from the OAuth2 provider is the `invalid_grant` error code, the user is marked as inactive. However, the user is able to reactivate their account by logging in the web browser through their OAuth2 flow. Also changed to support this is that a linked `ExternalLoginUser` is always created upon a login or signup via OAuth2. ### Notes on updating permissions Ideally, we would also refresh permissions from the configured OAuth provider (e.g., admin, restricted and group mappings) to match the implementation of LDAP. However, the OAuth library used for this `goth`, doesn't seem to support issuing a session via refresh tokens. The interface provides a [`RefreshToken` method](https://github.com/markbates/goth/blob/master/provider.go#L20), but the returned `oauth.Token` doesn't implement the `goth.Session` we would need to call `FetchUser`. Due to specific implementations, we would need to build a compatibility function for every provider, since they cast to concrete types (e.g. [Azure](https://github.com/markbates/goth/blob/master/providers/azureadv2/azureadv2.go#L132)) --------- Co-authored-by: Kyle D <kdumontnu@gmail.com>
* Fix tautological conditions (#30735)silverwind2024-04-301-1/+1
| | | | | | | As discovered by https://github.com/go-gitea/gitea/pull/30729. --------- Co-authored-by: Giteabot <teabot@gitea.io>
* Enable more `revive` linter rules (#30608)silverwind2024-04-221-1/+0
| | | | | | | | | | | Noteable additions: - `redefines-builtin-id` forbid variable names that shadow go builtins - `empty-lines` remove unnecessary empty lines that `gofumpt` does not remove for some reason - `superfluous-else` eliminate more superfluous `else` branches Rules are also sorted alphabetically and I cleaned up various parts of `.golangci.yml`.
* fix: Fix to delete cookie when AppSubURL is non-empty (#30375)Jonathan Tran2024-04-141-1/+2
| | | | | | | | Cookies may exist on "/subpath" and "/subpath/" for some legacy reasons (eg: changed CookiePath behavior in code). The legacy cookie should be removed correctly. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Kyle D <kdumontnu@gmail.com>
* Migrate margin and padding helpers to tailwind (#30043)silverwind2024-03-243-4/+4
| | | | | | | | | | | | | This will conclude the refactor of 1:1 class replacements to tailwind, except `gt-hidden`. Commands ran: ```bash perl -p -i -e 's#gt-(p|m)([lrtbxy])?-0#tw-$1$2-0#g' {web_src/js,templates,routers,services}/**/* perl -p -i -e 's#gt-(p|m)([lrtbxy])?-1#tw-$1$2-0.5#g' {web_src/js,templates,routers,services}/**/* perl -p -i -e 's#gt-(p|m)([lrtbxy])?-2#tw-$1$2-1#g' {web_src/js,templates,routers,services}/**/* perl -p -i -e 's#gt-(p|m)([lrtbxy])?-3#tw-$1$2-2#g' {web_src/js,templates,routers,services}/**/* perl -p -i -e 's#gt-(p|m)([lrtbxy])?-4#tw-$1$2-4#g' {web_src/js,templates,routers,services}/**/* perl -p -i -e 's#gt-(p|m)([lrtbxy])?-5#tw-$1$2-8#g' {web_src/js,templates,routers,services}/**/* ```
* Replace more gt- with tw- (#29678)silverwind2024-03-081-1/+1
| | | This will conclude the trivial class replacements.
* Move some asymkey functions to service layer (#28894)Lunny Xiao2024-03-042-4/+6
| | | | After the moving, all models will not depend on `util.Rename` so that I can do next step refactoring.
* Add user blocking (#29028)KN4CK3R2024-03-041-2/+2
| | | | | | | | | | | | | | | | | | | | | | Fixes #17453 This PR adds the abbility to block a user from a personal account or organization to restrict how the blocked user can interact with the blocker. The docs explain what's the consequence of blocking a user. Screenshots: ![grafik](https://github.com/go-gitea/gitea/assets/1666336/4ed884f3-e06a-4862-afd3-3b8aa2488dc6) ![grafik](https://github.com/go-gitea/gitea/assets/1666336/ae6d4981-f252-4f50-a429-04f0f9f1cdf1) ![grafik](https://github.com/go-gitea/gitea/assets/1666336/ca153599-5b0f-4b4a-90fe-18bdfd6f0b6b) --------- Co-authored-by: Lauris BH <lauris@nix.lv>
* remove util.OptionalBool and related functions (#29513)65432024-03-022-4/+4
| | | | | | and migrate affected code _last refactoring bits to replace **util.OptionalBool** with **optional.Option[bool]**_
* Revert "Support SAML authentication (#25165)" (#29358)65432024-02-249-560/+0
| | | | | | | | | | This reverts #25165 (5bb8d1924d77c675467694de26697b876d709a17), as there was a chance some important reviews got missed. so after reverting this patch it will be resubmitted for reviewing again https://github.com/go-gitea/gitea/pull/25165#issuecomment-1960670242 temporary Open #5512 again
* Start to migrate from `util.OptionalBool` to `optional.Option[bool]` (#29329)65432024-02-234-9/+8
| | | just create transition helper and migrate two structs
* Support SAML authentication (#25165)techknowlogick2024-02-239-0/+560
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Closes https://github.com/go-gitea/gitea/issues/5512 This PR adds basic SAML support - Adds SAML 2.0 as an auth source - Adds SAML configuration documentation - Adds integration test: - Use bare-bones SAML IdP to test protocol flow and test account is linked successfully (only runs on Postgres by default) - Adds documentation for configuring and running SAML integration test locally Future PRs: - Support group mapping - Support auto-registration (account linking) Co-Authored-By: @jackHay22 --------- Co-authored-by: jackHay22 <jack@allspice.io> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: KN4CK3R <admin@oldschoolhack.me> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Jason Song <i@wolfogre.com> Co-authored-by: morphelinho <morphelinho@users.noreply.github.com> Co-authored-by: Zettat123 <zettat123@gmail.com> Co-authored-by: Yarden Shoham <git@yardenshoham.com> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: silverwind <me@silverwind.io>
* Fix c/p error in inline documentation (#29148)Johan Van de Wauw2024-02-191-1/+1
| | | | | | | Fix small copy/paste error in inline documentation --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Use general token signing secret (#29205)wxiaoguang2024-02-181-8/+1
| | | Use a clearly defined "signing secret" for token signing.
* Refactor JWT secret generating & decoding code (#29172)wxiaoguang2024-02-161-1/+2
| | | | | | | | Old code is not consistent for generating & decoding the JWT secrets. Now, the callers only need to use 2 consistent functions: NewJwtSecretWithBase64 and DecodeJwtSecretBase64 And remove a non-common function Base64FixedDecode from util.go
* Unify user update methods (#28733)KN4CK3R2024-02-042-23/+25
| | | | | | | | | | | Fixes #28660 Fixes an admin api bug related to `user.LoginSource` Fixed `/user/emails` response not identical to GitHub api This PR unifies the user update methods. The goal is to keep the logic only at one place (having audit logs in mind). For example, do the password checks only in one method not everywhere a password is updated. After that PR is merged, the user creation should be next.
* Use db.Find instead of writing methods for every object (#28084)Lunny Xiao2023-11-242-2/+4
| | | | For those simple objects, it's unnecessary to write the find and count methods again and again.
* Refactor Find Sources and fix bug when view a user who belongs to an ↵Lunny Xiao2023-11-032-21/+35
| | | | | | | | | | | | unactive auth source (#27798) The steps to reproduce it. First, create a new oauth2 source. Then, a user login with this oauth2 source. Disable the oauth2 source. Visit users -> settings -> security, 500 will be displayed. This is because this page only load active Oauth2 sources but not all Oauth2 sources.
* Final round of `db.DefaultContext` refactor (#27587)JakobDev2023-10-142-8/+10
| | | Last part of #27065
* Penultimate round of `db.DefaultContext` refactor (#27414)JakobDev2023-10-112-7/+7
| | | | | | | Part of #27065 --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Fix ldap admin privileges update bug (#27051)CaiCandong2023-10-011-10/+7
| | | | | | | | | | | | When the user does not set a username lookup condition, LDAP will get an empty string `""` for the user, hence the following code ``` if isExist, err := user_model.IsUserExist(db.DefaultContext, 0, sr.Username) ``` The user presence determination will always be nonexistent, so updates to user information will never be performed. Fix #27049
* Another round of `db.DefaultContext` refactor (#27103)JakobDev2023-09-252-4/+4
| | | | | | | Part of #27065 --------- Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* Increase auth provider icon size on login page (#27122)silverwind2023-09-193-9/+11
| | | | | | | | | | | | | | | | | | Before, 20px: <img width="474" alt="Screenshot 2023-09-19 at 00 10 05" src="https://github.com/go-gitea/gitea/assets/115237/4bed4edb-219d-4844-9d3c-0d747033b09f"> After, 28px: <img width="576" alt="Screenshot 2023-09-19 at 00 20 40" src="https://github.com/go-gitea/gitea/assets/115237/f482ac09-38ae-4c84-80d9-0bd39b7f9772"> Dropdown in account settings is unchanged at 20px: <img width="157" alt="Screenshot 2023-09-19 at 00 09 11" src="https://github.com/go-gitea/gitea/assets/115237/9c998cdf-eeed-4118-9262-664faaa56092"> --------- Co-authored-by: Giteabot <teabot@gitea.io>
* Reduce usage of `db.DefaultContext` (#27073)JakobDev2023-09-148-22/+28
| | | | | | | | | | | | | | Part of #27065 This reduces the usage of `db.DefaultContext`. I think I've got enough files for the first PR. When this is merged, I will continue working on this. Considering how many files this PR affect, I hope it won't take to long to merge, so I don't end up in the merge conflict hell. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Improve LDAP group config documentation, fixes #21159 (#21227)Sven Seeberg2023-09-051-4/+5
| | | | Improve the wording of the LDAP group attributes documentation and expand the examples.
* Use `Set[Type]` instead of `map[Type]bool/struct{}`. (#26804)KN4CK3R2023-08-301-3/+4
|
* Use `object-fit: contain` for oauth2 custom icons (#26493)wxiaoguang2023-08-141-1/+1
|
* Handle base64 decoding correctly to avoid panic (#26483)wxiaoguang2023-08-141-10/+1
| | | Fix the panic if the "base64 secret" is too long.
* Bump github.com/golang-jwt/jwt to v5 (#25975)harryzcy2023-07-192-2/+5
| | | | | | | | | | | | | | | | Bumping `github.com/golang-jwt/jwt` from v4 to v5. `github.com/golang-jwt/jwt` v5 is bringing some breaking changes: - standard `Valid()` method on claims is removed. It's replaced by `ClaimsValidator` interface implementing `Validator()` method instead, which is called after standard validation. Gitea doesn't seem to be using this logic. - `jwt.Token` has a field `Valid`, so it's checked in `ParseToken` function in `services/auth/source/oauth2/token.go` --------- Co-authored-by: Giteabot <teabot@gitea.io>
* Replace `interface{}` with `any` (#25686)silverwind2023-07-042-16/+16
| | | | | Result of running `perl -p -i -e 's#interface\{\}#any#g' **/*` and `make fmt`. Basically the same [as golang did](https://github.com/golang/go/commit/2580d0e08d5e9f979b943758d3c49877fb2324cb).
* Log the real reason when authentication fails (but don't show the user) (#25414)Lunny Xiao2023-07-031-2/+37
|
* Change default email domain for LDAP users (#25425)Zettat1232023-06-222-2/+2
| | | | | Fixes #21169 Change `localhost` to `localhost.local`
* Fix LDAP sync when Username Attribute is empty (#25278)Zettat1232023-06-201-30/+32
| | | | | | | | | | | | | Fix #21072 ![image](https://github.com/go-gitea/gitea/assets/15528715/96b30beb-7f88-4a60-baae-2e5ad8049555) Username Attribute is not a required item when creating an authentication source. If Username Attribute is empty, the username value of LDAP user cannot be read, so all users from LDAP will be marked as inactive by mistake when synchronizing external users. This PR improves the sync logic, if username is empty, the email address will be used to find user.
generated by cgit v1.2.3 (git 2.39.1) at 2025-07-12 23:06:29 +0000