[Question] Send registration email when users login using LDAP for the first time

[rlukata]

I have setup Gitea to only use LDAP bind as authentication store, and users only need to enter their username/email and their ldap password to login and get an account created.

Is there a way to send a registration email to users who login via LDAP for the first time?

Here's the service snippet of my app.ini:

[service]
SHOW_REGISTRATION_BUTTON	  = false
REGISTER_EMAIL_CONFIRM            = true
ENABLE_NOTIFY_MAIL                = true
DISABLE_REGISTRATION              = false
ALLOW_ONLY_EXTERNAL_REGISTRATION  = true
ENABLE_CAPTCHA                    = false
REQUIRE_SIGNIN_VIEW               = true
DEFAULT_KEEP_EMAIL_PRIVATE        = false
DEFAULT_ALLOW_CREATE_ORGANIZATION = true
DEFAULT_ENABLE_TIMETRACKING       = true
NO_REPLY_ADDRESS                  = noreply.localhost
MINIMUM_KEY_SIZE_CHECK		  = false

[zeripath]

I'm afraid not at present - these are auto registrations.

[rlukata]

I'm afraid not at present - these are auto registrations.

Can this be requested as a feature? If yes, what do I need to do?

[zeripath]

OK... so I've just had a look at doing this.

It's a bit more involved than I would have hoped.

• First we'd need to add SendRegisterNotifyMail to models.LoginSource
• We'd need to refactor the actual functionality of LoginViaLDAP etc out of models likely into services
• Once that's happened we could use mailer.SendRegisterNotifyMail
• Then we need to adjust the UI for login sources to add this option.

The refactoring in step two is the difficult step. (It needs to be done though as this functionality doesn't really belong in models.)

[zeripath]

OK, #16199 does the basics to allow this to be possible, however I think we need some more details about how you think this would/should work.

1. PAM, Oauth2, SMTP and LDAP can all cause autoregistration - do you think that notification should be done for all of these - always? As a global setting?
2. If not do you think this should be an option for each individual login source?
3. Some sources may cause registration of a user who is prohibited from logging in. Should this notification still occur?

[rlukata]

PAM, Oauth2, SMTP and LDAP can all cause autoregistration - do you think that notification should be done for all of these - always? As a global setting?

Yes, and no.

If not do you think this should be an option for each individual login source?

Yes this would be ideal. In addition, I think it should be enabled by default.

Some sources may cause registration of a user who is prohibited from logging in. Should this notification still occur?

Yes, if an account gets created in the DB I think a notification should still occur. This is advantageous especially when troubleshooting: a user can use the email to claim they've "registered".