kontron / redmine_oauth

Redmine authentication through OAuth.
GNU General Public License v2.0
61 stars 27 forks source link

Self-Registration Behavior with Google Login #52

Closed tuzumkuru closed 1 month ago

tuzumkuru commented 1 month ago

I've noticed an issue with the self-registration feature of the plugin. When self-registration is set to "disabled," non-registered users trying to log in using their Google accounts receive the message: "Your account was created and is now pending administrator approval." An account is created and is waiting to be activated.

Environment: Redmine version: 5.1.3.stable Plugin version: 2.2.6 Running on: Docker

Expected Behavior: The plugin should restrict account creation based on the self-registration settings. If the self-registration option is disabled, users should not be able to create accounts through Google login.

Actual Behavior: Regardless of the self-registration setting, any user with a Google account can log in, and if their email is not found, an account is automatically created, even when the option is set to prevent self-registration.

Steps to Reproduce: Disable the self-registration option in Redmine. Attempt to log in with a Google account that does not have an existing Redmine account. Observe that the account is created and the user is informed that their account is pending administrator approval.

picman commented 1 month ago

Fixed in devel branch. By the way, there is a plugin's option Self-registration. The Redmine's option is not taken into account.

tuzumkuru commented 1 month ago

Thanks, Karel. I tried the change, and it is working as expected.

For clarity, the menu items could be improved as follows:

And also I think the sorting would be better like Disabled -> account activation by administrator approval -> self account activation by email verification -> automatic account activation

I can open a new issue if you would like to make the change or can make the change and send a pr.

Other than that, is it possible to restrict this login type with only some domains? Should it be done from the provider or is it possible to do through Redmine? I mean only accepting mails from some domains only and ignoring or rejecting others. I don't know where to discuss these kinds of things so asking it here.

picman commented 1 month ago

Yes, please create new issues dedicated for each problem. Pull requests are always welcomed.