{"action":"created","issue":{"url":"https://api.github.com/repos/go-gitea/gitea/issues/1036","repository_url":"https://api.github.com/repos/go-gitea/gitea","labels_url":"https://api.github.com/repos/go-gitea/gitea/issues/1036/labels{/name}","comments_url":"https://api.github.com/repos/go-gitea/gitea/issues/1036/comments","events_url":"https://api.github.com/repos/go-gitea/gitea/issues/1036/events","html_url":"https://github.com/go-gitea/gitea/issues/1036","id":209887878,"number":1036,"title":"Determine desired password-handling behavior for ExternalLoginUsers","user":{"login":"morrildl","id":52519,"avatar_url":"https://avatars3.githubusercontent.com/u/52519?v=4","gravatar_id":"","url":"https://api.github.com/users/morrildl","html_url":"https://github.com/morrildl","followers_url":"https://api.github.com/users/morrildl/followers","following_url":"https://api.github.com/users/morrildl/following{/other_user}","gists_url":"https://api.github.com/users/morrildl/gists{/gist_id}","starred_url":"https://api.github.com/users/morrildl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/morrildl/subscriptions","organizations_url":"https://api.github.com/users/morrildl/orgs","repos_url":"https://api.github.com/users/morrildl/repos","events_url":"https://api.github.com/users/morrildl/events{/privacy}","received_events_url":"https://api.github.com/users/morrildl/received_events","type":"User","site_admin":false},"labels":[{"id":474393850,"url":"https://api.github.com/repos/go-gitea/gitea/labels/kind/proposal","name":"kind/proposal","color":"5319e7","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/go-gitea/gitea/milestones/4","html_url":"https://github.com/go-gitea/gitea/milestone/4","labels_url":"https://api.github.com/repos/go-gitea/gitea/milestones/4/labels","id":2111552,"number":4,"title":"1.x.x","description":"","creator":{"login":"tboerger","id":156964,"avatar_url":"https://avatars3.githubusercontent.com/u/156964?v=4","gravatar_id":"","url":"https://api.github.com/users/tboerger","html_url":"https://github.com/tboerger","followers_url":"https://api.github.com/users/tboerger/followers","following_url":"https://api.github.com/users/tboerger/following{/other_user}","gists_url":"https://api.github.com/users/tboerger/gists{/gist_id}","starred_url":"https://api.github.com/users/tboerger/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tboerger/subscriptions","organizations_url":"https://api.github.com/users/tboerger/orgs","repos_url":"https://api.github.com/users/tboerger/repos","events_url":"https://api.github.com/users/tboerger/events{/privacy}","received_events_url":"https://api.github.com/users/tboerger/received_events","type":"User","site_admin":false},"open_issues":305,"closed_issues":1,"state":"open","created_at":"2016-11-03T08:40:47Z","updated_at":"2017-09-12T10:53:26Z","due_on":null,"closed_at":null},"comments":6,"created_at":"2017-02-23T21:22:08Z","updated_at":"2017-09-12T16:16:44Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"Filing per @strk via gitter, for discussion to arrive at a design.\r\n\r\n#679 and #1010 add support for logging in via OAuth2 (and \"OpenID Connect\") accounts; #618 adds support for (classic) OpenID. This bug is a proposal for how to handle local-to-gitea passwords for such accounts.\r\n\r\nFrom discussions on the above PRs and gitter, there seem to be 3 primary considerations:\r\n\r\n1. Need for some way to authenticate git-over-HTTP[S] writes\r\n2. Whether the local Gitea account is expected by users/admins to be recoverable/usable if the upstream OAuth2 account goes away (i.e. can you still log in if you delete your Google/FB/Github account, etc.)\r\n3. What are the right model & UI representations for such accounts & passwords (i.e. what LoginType, whether passwords should be toggle-able via admin UI, etc.)\r\n\r\nThe options I can think of are:\r\n\r\n* Suppress all passwords in UI for OAuth2 accounts, and forbid HTTP[S] git operations -- require SSH-git for these users (allowing HTTP[S] for local-only accounts)\r\n* Suppress (or make optional) passwords during OAuth2 self-reg, and use them only for HTTP-git operations\r\n* Make local passwords a first-class auth mechanism; basically this makes OAuth2 a secondary login mechanism [this is how the OAuth2 code currently works]\r\n\r\nBesides the above, there is also a secondary consideration:\r\n\r\n* How OAuth2 accounts should interact with self-registration: it's difficult to pre-register local accounts for OAuth2 because the \"real\" OAuth2 ID is typically an opaque string that it is essentially impossible for an admin to know in advance, meaning in practice you can't currently enable OAuth2 and also turn off self-registration\r\n\r\nFor this, there are again a few options:\r\n\r\n* Do not support disabling self-reg if OAuth2/OpenID is enabled as an auth source\r\n* Support disabling self reg, and add a feature allowing admins to restrict self-registrations to a whitelist of email domains\r\n* Support disabling self reg, and add a full-fledged \"these users have requested accounts\" moderation UI for admins\r\n"},"comment":{"url":"https://api.github.com/repos/go-gitea/gitea/issues/comments/328904177","html_url":"https://github.com/go-gitea/gitea/issues/1036#issuecomment-328904177","issue_url":"https://api.github.com/repos/go-gitea/gitea/issues/1036","id":328904177,"user":{"login":"lafriks","id":165205,"avatar_url":"https://avatars2.githubusercontent.com/u/165205?v=4","gravatar_id":"","url":"https://api.github.com/users/lafriks","html_url":"https://github.com/lafriks","followers_url":"https://api.github.com/users/lafriks/followers","following_url":"https://api.github.com/users/lafriks/following{/other_user}","gists_url":"https://api.github.com/users/lafriks/gists{/gist_id}","starred_url":"https://api.github.com/users/lafriks/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lafriks/subscriptions","organizations_url":"https://api.github.com/users/lafriks/orgs","repos_url":"https://api.github.com/users/lafriks/repos","events_url":"https://api.github.com/users/lafriks/events{/privacy}","received_events_url":"https://api.github.com/users/lafriks/received_events","type":"User","site_admin":false},"created_at":"2017-09-12T16:16:44Z","updated_at":"2017-09-12T16:16:44Z","author_association":"MEMBER","body":"@peterahl I think currently noone is working on this"}}
{"actor":{"display_login":"lafriks"}}