diff options
| author | Douwe Maan <douwe@gitlab.com> | 2016-06-30 15:42:15 +0000 |
|---|---|---|
| committer | Douwe Maan <douwe@gitlab.com> | 2016-06-30 15:42:15 +0000 |
| commit | 5e6342b7ac08b4b37b233cad54f4aeaf0144b977 (patch) | |
| tree | 846fda82cc1a09464c3099012176038ac2ba7c24 /doc | |
| parent | 293cf09056250c975c2b221f348b629b6d424b71 (diff) | |
| parent | 10444f61f85219eb6b2c10586996717d3b0afa8b (diff) | |
| download | gitlab-ce-5e6342b7ac08b4b37b233cad54f4aeaf0144b977.tar.gz | |
Merge branch '19312-confidential-issue' into 'master'
Fix privilege escalation issue with OAuth external users
Related to https://gitlab.com/gitlab-org/gitlab-ce/issues/19312
This MR fixes a privilege escalation issue, where manually set external users would be reverted back to internal users if they logged in via OAuth and that provider was not in the `external_providers` list.
/cc @douwe
See merge request !1975
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/integration/omniauth.md | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/doc/integration/omniauth.md b/doc/integration/omniauth.md index 820f40f81a9..46b260e7033 100644 --- a/doc/integration/omniauth.md +++ b/doc/integration/omniauth.md @@ -127,9 +127,15 @@ The chosen OmniAuth provider is now active and can be used to sign in to GitLab This setting was introduced with version 8.7 of GitLab You can define which OmniAuth providers you want to be `external` so that all users -creating accounts via these providers will not be able to have access to internal -projects. You will need to use the full name of the provider, like `google_oauth2` -for Google. Refer to the examples for the full names of the supported providers. +**creating accounts, or logging in via these providers** will not be able to have +access to internal projects. You will need to use the full name of the provider, +like `google_oauth2` for Google. Refer to the examples for the full names of the +supported providers. + +>**Note:** +If you decide to remove an OmniAuth provider from the external providers list +you will need to manually update the users that use this method to login, if you +want their accounts to be upgraded to full internal accounts. **For Omnibus installations** |