This repository was archived by the owner on Apr 26, 2024. It is now read-only.
Allow disabling registration via OIDC and only limiting SSO to sign-in #11968
Description
Description:
For some setups that don't allow user registration it may be worthwhile to allow OIDC or OAuth2.0 sign-in for user convenience. However, I haven't found a way to disable creation of new users via OIDC. Sign-in works, but it also enables new users to sign-in to the server freely.
It would be great to change allow_existing_users (or have a new setting) with an enum:
no= don't allow sign-in for an existing useryes= allow sign-in for a pre-existing user w/o OIDC mappingonly= impliesyes, but additionaly restricts the sign-in to match only pre-existing users
Activity
clokep commentedon Feb 11, 2022
If you want to limit using Synapse to a subset of your SSO users you can likely use probably use the
attribute_requirementsflag on the OIDC provider config. (SAML has something similar too.)digitalentity commentedon Feb 11, 2022
Good point, but it doesn't cover my use-case unfortunately. In my case users are created on my homeserver and I would like them to be able to authenticate via their Google accounts.
There is no distinction between a Google account of a user who is allowed to access my server and Google account of a user who shouldn't access my server - therefore attribute_requirements won't give me an option to prevent an arbitrary user from signing up.
clokep commentedon Feb 11, 2022
I'm a bit confused about you use-case, is your hope that you can:
Does that match what you're trying to do?
If so, I think you can implement 3 by putting something bogus in
attribute_requirementssince it is only checked during creation of the user.I do wonder if the SSO code should check
enable_registrationflag though. Although I suspect it can't really cause that's for different flows...digitalentity commentedon Feb 11, 2022
Precisely. I didn't know that
attribute_requirementsis checked only during user creation and is not checked during the user login. That's indeed a suitable workaround, although rather fragile IMO.I was wonder about that as well. Creation of a new user is effectively registration, imagine how surprised I was when I saw new users on my server created despite
enable_registrationbeingfalse😄clokep commentedon Feb 11, 2022
It is a bit of a hack (and probably a bug that it doesn't check it at each login...)
👍 Yeah, I understand now what you're hoping for!
warrenbailey commentedon Feb 3, 2023
I had this problem too, I was seeing users being registered that didn't have an account but did have a valid SSO sign in.
I've raised a PR which adds a check to the OIDC flow for the enabled registration flag. If it's disabled it raises an error and stops the user being registered automatically. They are then redirected to the error page.