Prevent Omniauth signup redirect loop
Eliminate omniauth redirect loop when new user cannot be created
When there is an omniauth-style user signup issue (after a successful 3rd party authentication), the user is getting redirected to sign in page. However, if auto sign in is turned on, they are getting redirected back to the 3rd party auth, which in turn, redirect them to the omniauth callback again. This happens until the browser gives up.
Companion issue: #194189 (closed)
Does this MR meet the acceptance criteria?
Conformity
-
Changelog entry -
Documentation (if required) -
Code review guidelines -
Merge request performance guidelines -
Style guides -
Database guides -
Separation of EE specific content
Note: this issue could be done completely outside of EE-specific parts, but the tests reveal an issue in EE code. Advice is appreciated.
Availability and Testing
This setting was in place between 10.2 and 11.3 in Enterprise Edition, and while the original MR (!3223 (merged)) mentioned the need to have it merged to CE, it never happened. Then, the CE -> EE mergeback before 11.4 brought the original, faulty behavior back.
-
Review and add/update tests for this feature/bug. Consider all test levels. See the Test Planning Process.
Security
If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:
-
Label as security and @ mention @gitlab-com/gl-security/appsec -
The MR includes necessary changes to maintain consistency between UI, API, email, or other methods -
Security reports checked/validated by a reviewer from the AppSec team