Skip to content

Disable Arkose for Group SAML users

Alex Buijs requested to merge disable-arkose-for-group-saml-users into master

What does this MR do and why?

When registering, signing up or verifying identity, skip Arkose verification for group SAML users.

When unconfirmed group SAML users try to login with email + password combination in the /users/sign_in form, they get an Arkose score. When the assigned score is medium or high, they cannot login through SAML anymore. The only workaround is to request a new password, login with email + new password and complete identity verification.

Issue: https://gitlab.com/gitlab-org/modelops/anti-abuse/team-tasks/-/issues/421

How to set up and validate locally

  1. Configure GitLab for SCIM
  2. Configure an identity provider
  3. Provision a user from the identity provider
  4. SAML sign in from the identity provider
  5. Verify the message Please confirm your email address is shown on the sign in page
  6. Try to login with the new provisioned user's email address and a random password
  7. Confirm the new user's email address
  8. SAML sign in from the identity provider
  9. Verify login is successful

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Alex Buijs

Merge request reports