Username should be able to be an email address

[keleathi]

• Gitea version (or commit ref): 1.4.1
• Git version: 2.17.0
• Operating system: FreeBSD
• Database (use [x]):
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (provide example URL)
  • No
  • [X ] Not relevant
• Log gist:
  Failed to login '[email protected]' via 'ldap2.domain.local': Invalid pattern for attribute 'username' [[email protected]]: must be valid alpha or numeric or dash(-_) or dot characters

Description

Users in my ldap directory only have a full email address as their "uid" and therefore their username (for several reasons). I cannot get gitea to function in such an environment, because of the following check in login_source.go:

if binding.AlphaDashDotPattern.MatchString(sr.Username) {
return nil, fmt.Errorf("Invalid pattern for attribute 'username' [%s]: must be valid alpha or numeric or dash(-_) or dot characters", sr.Username)
}

It would be wonderful if the check allowed for "@" characters as well.

Thank you!
...

Screenshots

[benyanke]

Thought: perhaps this should be a boolean option, since it could break other things.

[sbstp]

What would the users slug be in the URLs? gitea.com/[email protected]/<repo>? I think there are allowed characters in email addresses that are not allowed in URLs.

[chossimbaone]

This will also be nice for multi forrest ad users.

[clarfonthey]

@sbstp are you sure? I'm fairly certain that this could be done.

Mentions for these emails would also work, using @user@domain like Mastodon and other ActivityPub-based systems do.

[techknowlogick]

Federation is currently being worked on (via a separate working group), and so this is something that will need to be evaluated in that context, as if emails are allowed, how would we mention across instances if an account on one instance is an email, especially if it contains a domain that doesn't match the domain of the git server.

[tommie]

I have reverse proxy authentication set up. My Apache uses OpenID Connect, and I use it as SSO for a bunch of personal things.

When I use a Google identity, the default for mod_auth_openidc is to use "sub" as the remote user, which is a long integer and domain: [email protected]

I've changed it to use the "email" claim instead, which means it still contains an @-sign.

Whenever I go to my profile page (for either of them) and try to change my username, it seems a new user is created. When I try to change anything else (and leaving username alone), it rejects it saying the username is invalid.

It would indeed be nice to make that work. Since I want auto-registration (and handle authorization in Apache), I can't guarantee user-ID uniqueness except if it includes the domain.

[lafriks]

that should probably be handled in oauth instead by for example replacing @ sign with - or something like that

[realslacker]

Maybe it would work to change just the sanitizeUserDN to replace all instances of %s instead of just using sprintf for the first. Then you could use an LDAP filter like:

(&(objectClass=user)(|(sAMAccountName=%s)(UserPrincipalName=%s)(mail=%s)))

[wilful]

I have a similar problem. My LDAP has Mail and userPrincipalName. I do like this:

User Filter: (|(userPrincipalName=%[1]s)(mail=%[1]s))
username: userPrincipalName

userPrincipalName like as [email protected]
mail like as [email protected]

After that, the user can log in by mail of the form: [email protected]
Username is userPrincipalName, i.e. Link to the profile is obtained as follows:
https://git.domain.ltd/[email protected]
And this works, but if I try to use userPrincipalName with login, I get:

2020/01/24 12:44:31 ...dels/login_source.go:717:UserSignIn() [W] Failed to login '[email protected]' via 'LDAP': Invalid pattern for attribute 'username' [[email protected]]: must be valid alpha or numeric or dash(-_) or dot characters

[bipinmathew]

Was this functionality lost again? I was able to use LDAP emails as user-ids in version 1.7.0, but when I upgraded to version 1.12.0+dev-171-g12960b9d1 it does not seem to work any more, and with the same error:

Error creating user @: User name is invalid [@]: must be valid alpha or numeric or dash(-_) or dot characters

[ceelian]

Any news on this topic for version 1.12?

[zeripath]

@voidbip yes unfortunately the functionality had to be lost due to a security issue with it.

What we need to do is allow LDAP to provide a mapping function from an email address to a username.

[LeDevAlsacien]

Hello, i'm trying to use our LDAP as authentification.

the user usually use email to authenticate and we can't use UID as is one letter and digit (ex: r160459) so the user can't remember that kind of information.

Any news for future version of gitea ?

thanks !

Edit: found a workaround, we have an LDAP attribute that we can use with "Name.GivenName" that work pretty well 👍

[wxiaoguang]

Years ago, I also used E-mail as username in LDAP and other systems. Then I have to admit that this is one of most bad mistakes I have made. Using E-mail as username leads to various problems. Then our team spent more time to migrate the account system from E-mail username to regular username.

Even if you have different companies/organizations/domains, even if you want to use different domains for E-mails, do not use E-mail as username. You can have a unique regular username in you system and map it to different E-mails.

So I would always down vote for the E-mail as username decision (of course, you can login via E-mail address which is mapped to a regular username).

[techknowlogick]

Closing per reasons above