LDAP for user sync only and only OIDC for login

[olivierlambert]

Feature Description

I'm currently using Gitea with LDAP (for user sync) + oidc( for strong auth, 2FA enable in Keycloak). It works well, Gitea is able to consolidate the users on first login via oidc.

However, I'd like to remove the LDAP login (which is not with 2FA) to only leave oidc as a choice to login.

If I disable the LDAP auth source, people can't consolidate their account anymore on first login. Is there an elegant solution to this?

Screenshots

No response

[svenseeberg]

While it is probably not elegant and I have not yet tested it: couldn't you set the user filter to something that does not work? For example (null=%s)? Ah never mind. Users would not be able to merge the accounts then, because they need the working login.

[olivierlambert]

Ah indeed! Is something like this planned for a future version? Maybe my method of LDAP to sync and OIDC isn't the "best practice"?

[svenseeberg]

I'm not aware of such a feature.

What you can also do is update the login_source, login_type and login_name for all users in the user table. Maybe there is also another field that needs to be touched. The SQL structure is not that difficult though. But please test thoroughly ;-)