Skip to content

Unable to restrict access when Gitlab authentication is configured

Created by: pseudonator

  • Sourcegraph version: 3.27.4
  • Platform information: Running on Docker 19.03.14

Steps to reproduce:

  1. Self hosted Sourcegraph instance.
  2. Enabled OAuth 2 with code host permission sync on Gitlab.com
  3. AuthN and AuthZ works as expected however Authentication is enabled globally which means anyone who has access to Gitlab.com can login and create accounts in Sourcegraph

Expected behavior:

Restricted to allow registrations on demand. Similar to how it works for Github authentication with allowSignup flag.

Actual behavior:

Anyone who has access to Gitlab.com (Globally) can login and create an account on Sourcegraph. This definitely appears to be a security risk.