Introduce an environment variable to control user creation in OIDC authentication, closes #47

services/web/app/src/infrastructure/Features.mjs

@@ -53,7 +53,7 @@ const Features = {
       case 'registration-page':
         return (
           !Features.externalAuthenticationSystemUsed() ||
-          Boolean(Settings.overleaf)
+          Boolean(Settings.overleaf) || Settings.oidc?.disableJITAccountCreation
         )
       case 'registration':
         return Boolean(Settings.overleaf)

services/web/modules/authentication/oidc/app/src/OIDCAuthenticationController.mjs

@@ -42,7 +42,8 @@ const OIDCAuthenticationController = {
           }
         } else {
           if (info.redir != null) {
-            return res.json({ redir: info.redir })
+            await UserController.doLogout(req)
+            return res.redirect(info.redir)
           } else {
             res.status(info.status || 401)
             delete info.status
@@ -95,20 +96,19 @@ const OIDCAuthenticationController = {
         info: {
           type: 'error',
           text: error.message,
-          status: 401,
+          status: 500,
         },
       }
     }
     if (user) {
       return { user, info: undefined }
-    } else { // we cannot be here, something is terribly wrong
+    } else { // user account is not created
-      logger.debug({ email : profile.emails[0].value }, 'failed OIDC log in')
+      logger.debug({ email : profile.emails[0].value }, 'OIDC users JIT account creation is off')
       return {
         user: false,
         info: {
-          type: 'error',
+          redir: '/register',
-          text: 'Unknown error',
+          status: 401,
-          status: 500,
         },
       }
     }

services/web/modules/authentication/oidc/app/src/OIDCAuthenticationManager.mjs

@@ -37,6 +37,9 @@ const OIDCAuthenticationManager = {
 // (Is it safe? Concider: If an account from the specified provider is already linked to this user, throw an error)
       user = await User.findOne({ 'email': email }).exec()
       if (!user) {
+        if (Settings.oidc.disableJITAccountCreation) {
+          return null
+        }
         user = await UserCreator.promises.createNewUser(
           {
             email: email,

services/web/modules/authentication/oidc/app/src/OIDCModuleManager.mjs

@@ -17,6 +17,7 @@ const OIDCModuleManager = {
       attAdmin:     process.env.OVERLEAF_OIDC_IS_ADMIN_FIELD,
       valAdmin:     process.env.OVERLEAF_OIDC_IS_ADMIN_FIELD_VALUE,
       updateUserDetailsOnLogin: boolFromEnv(process.env.OVERLEAF_OIDC_UPDATE_USER_DETAILS_ON_LOGIN),
+      disableJITAccountCreation: boolFromEnv(process.env.OVERLEAF_OIDC_DISABLE_JIT_ACCOUNT_CREATION),
     }
   },
   passportSetup(passport, callback) {