Unable to restrict access when Gitlab authentication is configured
Created by: pseudonator
- Sourcegraph version: 3.27.4
- Platform information: Running on Docker 19.03.14
Steps to reproduce:
- Self hosted Sourcegraph instance.
- Enabled OAuth 2 with code host permission sync on Gitlab.com
- AuthN and AuthZ works as expected however Authentication is enabled globally which means anyone who has access to Gitlab.com can login and create accounts in Sourcegraph
Expected behavior:
Restricted to allow registrations on demand. Similar to how it works for Github authentication with allowSignup
flag.
Actual behavior:
Anyone who has access to Gitlab.com (Globally) can login and create an account on Sourcegraph. This definitely appears to be a security risk.