Skip to content

Configuring OmniAuth does not prevent standard GitLab authentication

Description

This issues originates from the same source as these two issues:

  1. Impersonation Tokens
  2. Preventing Users from disconnecting GitLab account from CAS

We're collaborating with a very large and strategic organization and this issue is feedback they had sent me as part of their evaluation of GitLab.

Configuring OmniAuth does not prevent standard GitLab authentication. Since the GitLab password won't be automatically set and won't be in sync with the password users used to authenticate with CAS, this will cause confusion for our users. We need to disable this and require users to use SSH keys or personal access tokens for Git reads/writes.