Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Allow users without password (LDAP, OIDC/OAuth) to delete their own account #18329

Open
BaseCrusher opened this issue Jan 19, 2022 · 5 comments · May be fixed by #28950
Open

Allow users without password (LDAP, OIDC/OAuth) to delete their own account #18329

BaseCrusher opened this issue Jan 19, 2022 · 5 comments · May be fixed by #28950
Labels
topic/authentication type/proposal The new feature has not been accepted yet but needs to be discussed first.

Comments

@BaseCrusher
Copy link

Gitea Version

1.15.8

Git Version

--

Operating System

Linux

How are you running Gitea?

Docker (But doesnt matter)

Database

PostgreSQL

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Description

A user that has an external account cant delete his account.
In order to delete it he has to put in his password. But external users do not have a password.

Screenshots

No response
@lunny
Copy link
Member

lunny commented Jan 20, 2022

For LDAP users, they may not be allowed to be deleted by themselves?

@BaseCrusher
Copy link
Author

Ok, this might make some sense.
Still i would suggest, to have an option to turn this off.

For example, I have created an account at the Gitea demo server, using Githubs OICD. Now i would for example like to delete it. But i can't. I mean sure. I could remove the authenthication through Github, but it would still leave an account on the Gitea Server.

Though I have to admit, I don't know that much about LDAP. So I could be totaly wrong here.

@wxiaoguang
Copy link
Contributor

A possible solution could be: we save the external login time in session, then if a user wants to delete the account within 1 minute after login, we allow it. This solution make every user have a chance to delete their account with a fresh external login.

@BaseCrusher
Copy link
Author

I am still struggeling with understanding why a user that is externaly logged in shouldnt be able to delete his/hers account.

@wxiaoguang
Copy link
Contributor

They should, but it needs someone to work on a PR for this feature.

@wxiaoguang wxiaoguang added the type/proposal The new feature has not been accepted yet but needs to be discussed first. label Jan 25, 2022
@wxiaoguang wxiaoguang changed the title Only admin can delete external accounts Allow users without password (LDAP, OIDC) to delete their own account Jan 25, 2022
@wxiaoguang wxiaoguang changed the title Allow users without password (LDAP, OIDC) to delete their own account Allow users without password (LDAP, OIDC/OAuth) to delete their own account Apr 16, 2022
@wxiaoguang wxiaoguang mentioned this issue Apr 16, 2022
Closed
@wackbyte wackbyte linked a pull request Jan 27, 2024 that will close this issue
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
topic/authentication type/proposal The new feature has not been accepted yet but needs to be discussed first.
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Fix account deletion for users without passwords wackbyte/gitea
4 participants
@lunny @wxiaoguang @BaseCrusher @delvh