[FF] `link_omniauth_to_existing_user_on_login` -- Prompt to login to link existing account to new OAuth identity

Summary

Roll out the feature currently behind the link_omniauth_to_existing_user_on_login feature flag.

When auto_link_user is disabled and a user signs in with an OmniAuth provider whose email matches an existing GitLab account, the flag replaces the generic 422 error page with a guided flow: the user is prompted to sign in with an existing method, then link the OmniAuth identity to their account.

DRI: @leetickett-gitlab
Introduced by: !246957 (merged)

Note

Process and guidance live in the docs — this issue is just the commands and a place to track the rollout. "Rolling out" means incrementally enabling the flag on GitLab.com to validate stability — it is not the same as releasing the feature, which happens when the flag is removed. Feature flag controls · Feature flag lifecycle

What could go wrong?

Blast radius is limited to OmniAuth sign-ins where auto_link_user is disabled and the provider email collides with an existing account — a path that today always fails with a 422. When the flag is off, behaviour is unchanged (the original 422). The identity is only linked after the user authenticates with an existing method, so no auto-linking happens on email trust alone.

Rollout

Run all production /chatops in #production. Background: incremental rollout process, feature actors.

Non-production

/chatops gitlab run feature set link_omniauth_to_existing_user_on_login 50 --actors --dev --pre --staging --staging-ref
/chatops gitlab run feature set link_omniauth_to_existing_user_on_login true --dev --pre --staging --staging-ref

Production — percentage rollout (wait ≥15 min between steps, watch dashboards):

/chatops gitlab run feature set link_omniauth_to_existing_user_on_login <percentage> --actors

Or target specific actors instead:

/chatops gitlab run feature set --project=gitlab-org/gitlab,gitlab-org/gitlab-foss link_omniauth_to_existing_user_on_login true
/chatops gitlab run feature set --group=gitlab-org,gitlab-com link_omniauth_to_existing_user_on_login true
/chatops gitlab run feature set --user=leetickett-gitlab link_omniauth_to_existing_user_on_login true

Before global rollout

Confirm the relevant gotchas before going to 100% — see enabling a feature for GitLab.com:

Docs + version history updated
Breaking changes announced, if any
Change management issue opened, if required
External API consumers handled with a fail-open mechanism, if applicable

Cleanup

Remove the flag once deemed stable — see cleaning up. Remove the flag and its YAML definition from the codebase, then:

/chatops gitlab run release check gitlab-org/gitlab!246957 <milestone>
/chatops gitlab run feature delete link_omniauth_to_existing_user_on_login --dev --pre --staging --staging-ref --production

Rollback

/chatops gitlab run feature set link_omniauth_to_existing_user_on_login false                                         # production
/chatops gitlab run feature set link_omniauth_to_existing_user_on_login false --dev --pre --staging --staging-ref     # non-production
/chatops gitlab run feature delete link_omniauth_to_existing_user_on_login --dev --pre --staging --staging-ref --production  # remove entirely

🤖 This content was generated by GitLab Duo.

[FF] link_omniauth_to_existing_user_on_login -- Prompt to login to link existing account to new OAuth identity