nextcloud / nextcloud/user_oidc
How to handle OIDC login of a user who already exists as a DB one?
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 181
- Forks
- 60
- Avg merge
- 7h 34m
- Merged PRs (30d)
- 26
Description
If a user exists as a DB one and then authenticates with user_oidc, the row in oc_users is still there. The user is then handled by 2 backends.
So if the user_oidc user is deleted, the DB one still exists and can log in.
How could we improve this?
One solution would be to let admins set a provider-specific setting flag to choose what happens when user_oidc finds a database user with the same id on OIDC login:
- delete the database user and proceed. still one question there, should we:
- really delete it (storage, data etc...)?
- just make sure it's not a database user anymore but keep the storage+data?
- deny the authentication
@juliushaertl
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no files, tests, or entry points, so begin by locating the user_oidc login handling and the database-user lookup. Before implementation, maintainers need to decide whether to deny authentication, delete the existing user, or preserve its storage and data; done criteria are not yet defined.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authentication
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100