Removing 2FA authenticator as a member of groups requiring 2FA soft-locks account
Summary
Removing a linked 2FA-authenticator (Google Authenticator) while being a member of groups requiring 2FA soft-locks the account.
Gitlab lists the relevant groups and provides links to leave them - following the link leads to an 403 - Access Forbidden
, likely due to the unmet 2FA requirement on these groups.
Following any other link redirects to the 2FA setup section of one's user settings page.
Note: I am also a member of the global admins of the instance.
Related to gitlab-ce#48088, gitlab-ce#53453.
Steps to reproduce
Set up 2FA with an OTP authenticator, join a group with a 2FA requirement and then remove the registered authenticator on the user settings page.
What is the current bug behavior?
- Leaving the groups in question (via the provided links) is not possible.
- Using any site functionality not tied to a 2FA requirement is not possible.
What is the expected correct behavior?
- Leaving the groups in question (via the provided links) should be possible.
- Using any site functionality not tied to a 2FA requirement should be possible, e.g. other user settings, browsing projects.
Relevant logs and/or screenshots
Output of checks
Results of GitLab environment info
Expand for output related to GitLab environment info
System information System: Current User: git Using RVM: no Ruby Version: 2.6.3p62 Gem Version: 2.7.9 Bundler Version:1.17.3 Rake Version: 12.3.2 Redis Version: 3.2.12 Git Version: 2.21.0 Sidekiq Version:5.2.7 Go Version: unknown
GitLab information Version: 12.0.3 Revision: 08a51a9db93 Directory: /opt/gitlab/embedded/service/gitlab-rails DB Adapter: PostgreSQL DB Version: 9.6.11 URL: https://$REDACTED_SITE_URL HTTP Clone URL: https://$REDACTED_SITE_URL/some-group/some-project.git SSH Clone URL: ssh://git@$REDACTED_SITE_URL:2222/some-group/some-project.git Using LDAP: yes Using Omniauth: yes Omniauth Providers:
GitLab Shell Version: 9.3.0 Repository storage paths:
- default: /data/git/repositories GitLab Shell path: /opt/gitlab/embedded/service/gitlab-shell Git: /opt/gitlab/embedded/bin/git
Results of GitLab application Check
Expand for output related to the GitLab application check
Checking GitLab subtasks ...
Checking GitLab Shell ...
GitLab Shell: ... GitLab Shell version >= 9.3.0 ? ... OK (9.3.0) Running /opt/gitlab/embedded/service/gitlab-shell/bin/check Check GitLab API access: OK Redis available via internal API: OK
Access to /var/opt/gitlab/.ssh/authorized_keys: OK gitlab-shell self-check successful
Checking GitLab Shell ... Finished
Checking Gitaly ...
Gitaly: ... default ... OK
Checking Gitaly ... Finished
Checking Sidekiq ...
Sidekiq: ... Running? ... yes Number of Sidekiq processes ... 1
Checking Sidekiq ... Finished
Checking Incoming Email ...
Incoming Email: ... Reply by email is disabled in config/gitlab.yml
Checking Incoming Email ... Finished
Checking LDAP ...
LDAP: ... Server: ldapmain LDAP authentication... Success LDAP users with access to your GitLab server (only showing the first 100 results)
$REDACTED_LDAP_USER_LISTING
Checking LDAP ... Finished
Checking GitLab App ...
Git configured correctly? ... yes Database config exists? ... yes All migrations up? ... yes Database contains orphaned GroupMembers? ... no GitLab config exists? ... yes GitLab config up to date? ... yes Log directory writable? ... yes Tmp directory writable? ... yes Uploads directory exists? ... yes Uploads directory has correct permissions? ... yes Uploads directory tmp has correct permissions? ... yes Init script exists? ... skipped (omnibus-gitlab has no init script) Init script up-to-date? ... skipped (omnibus-gitlab has no init script) Projects have namespace: ... 2/3 ... yes 2/5 ... yes 37/6 ... yes 9/7 ... yes 13/8 ... yes 13/9 ... yes 13/10 ... yes 41/11 ... yes 37/12 ... yes 43/13 ... yes 52/17 ... yes 5/19 ... yes 5/21 ... yes 49/22 ... yes 16/24 ... yes 43/25 ... yes 53/27 ... yes 37/28 ... yes 9/29 ... yes 5/30 ... yes 5/31 ... yes 49/32 ... yes 10/35 ... yes 35/36 ... yes 79/37 ... yes 5/39 ... yes 53/42 ... yes 5/62 ... yes 53/65 ... yes 2/66 ... yes 93/69 ... yes 80/70 ... yes 80/71 ... yes 21/75 ... yes 37/76 ... yes 80/77 ... yes 80/78 ... yes 92/81 ... yes 4/82 ... yes 4/83 ... yes 25/84 ... yes 50/85 ... yes 17/87 ... yes 94/89 ... yes 95/90 ... yes 2/91 ... yes 50/92 ... yes 51/93 ... yes 37/95 ... yes 80/96 ... yes 80/97 ... yes 91/98 ... yes 90/99 ... yes 80/100 ... yes 92/101 ... yes 99/102 ... yes 99/103 ... yes 99/104 ... yes 100/105 ... yes 80/106 ... yes 80/107 ... yes 99/108 ... yes 80/109 ... yes 37/111 ... yes 100/112 ... yes 17/113 ... yes 106/114 ... yes 2/115 ... yes 37/116 ... yes 37/117 ... yes 37/118 ... yes 37/119 ... yes 108/120 ... yes 92/122 ... yes 20/124 ... yes 49/125 ... yes 80/126 ... yes 103/127 ... yes 2/128 ... yes 2/130 ... yes 37/131 ... yes 37/132 ... yes 9/133 ... yes 80/134 ... yes 80/135 ... yes 80/136 ... yes 103/137 ... yes 108/139 ... yes 5/140 ... yes 5/141 ... yes 118/143 ... yes 118/144 ... yes 118/148 ... yes 118/150 ... yes 118/151 ... yes 118/153 ... yes 118/154 ... yes 118/155 ... yes 118/156 ... yes 25/157 ... yes 2/158 ... yes 120/159 ... yes 2/160 ... yes 35/161 ... yes 41/162 ... yes 14/163 ... yes 22/164 ... yes 132/166 ... yes 17/167 ... yes 37/168 ... yes 84/169 ... yes 100/170 ... yes 37/171 ... yes 132/172 ... yes 132/173 ... yes 136/174 ... yes 47/175 ... yes 47/176 ... yes 47/177 ... yes 47/178 ... yes 10/180 ... yes 10/182 ... yes 10/183 ... yes 37/184 ... yes 5/186 ... yes 37/187 ... yes 2/188 ... yes 49/189 ... yes 2/190 ... yes 47/191 ... yes 141/192 ... yes 5/194 ... yes 37/195 ... yes 37/196 ... yes 43/197 ... yes 37/198 ... yes 226/199 ... yes 226/200 ... yes 226/202 ... yes 226/203 ... yes 10/204 ... yes 226/205 ... yes 226/206 ... yes 226/207 ... yes 140/208 ... yes 140/210 ... yes 123/213 ... yes 146/214 ... yes 146/215 ... yes 146/216 ... yes 146/217 ... yes 226/218 ... yes 5/219 ... yes 226/220 ... yes 93/221 ... yes 226/222 ... yes 132/223 ... yes 132/226 ... yes 5/227 ... yes 123/228 ... yes 52/229 ... yes 103/230 ... yes 150/231 ... yes 150/232 ... yes 150/233 ... yes 152/235 ... yes 100/236 ... yes 155/238 ... yes 155/239 ... yes 155/240 ... yes 155/242 ... yes 155/243 ... yes 2/244 ... yes 21/245 ... yes 166/246 ... yes 2/247 ... yes 100/249 ... yes 47/251 ... yes 5/252 ... yes 5/253 ... yes 166/257 ... yes 179/258 ... yes 45/259 ... yes 92/260 ... yes 45/261 ... yes 37/262 ... yes 2/264 ... yes 2/265 ... yes 2/266 ... yes 55/268 ... yes 172/269 ... yes 175/278 ... yes 176/279 ... yes 176/280 ... yes 117/282 ... yes 152/283 ... yes 28/284 ... yes 9/287 ... yes 179/289 ... yes 47/290 ... yes 180/291 ... yes 52/292 ... yes 37/293 ... yes 172/295 ... yes 37/296 ... yes 55/297 ... yes 5/299 ... yes 172/300 ... yes 100/301 ... yes 192/302 ... yes 192/303 ... yes 5/305 ... yes 5/306 ... yes 192/307 ... yes 192/308 ... yes 4/309 ... yes 145/312 ... yes 192/314 ... yes 192/318 ... yes 37/319 ... yes 37/320 ... yes 166/321 ... yes 172/322 ... yes 22/323 ... yes 37/325 ... yes 52/327 ... yes 172/328 ... yes 172/329 ... yes 52/330 ... yes 52/331 ... yes 210/333 ... yes 37/336 ... yes 37/337 ... yes 406/338 ... yes 192/339 ... yes 20/341 ... yes 210/342 ... yes 52/343 ... yes 172/344 ... yes 2/345 ... yes 92/346 ... yes 220/347 ... yes 192/348 ... yes 220/353 ... yes 2/354 ... yes 17/355 ... yes 37/356 ... yes 37/357 ... yes 37/358 ... yes 192/359 ... yes 225/360 ... yes 116/362 ... yes 2/364 ... yes 2/365 ... yes 22/366 ... yes 229/367 ... yes 230/369 ... yes 52/370 ... yes 93/371 ... yes 5/372 ... yes 38/373 ... yes 100/374 ... yes 237/375 ... yes 87/376 ... yes 237/377 ... yes 238/378 ... yes 172/379 ... yes 93/380 ... yes 237/381 ... yes 245/383 ... yes 140/384 ... yes 237/385 ... yes 80/386 ... yes 2/387 ... yes 100/388 ... yes 247/389 ... yes 41/390 ... yes 140/392 ... yes 247/393 ... yes 247/394 ... yes 247/395 ... yes 37/396 ... yes 37/397 ... yes 140/398 ... yes 92/399 ... yes 92/400 ... yes 22/401 ... yes 52/402 ... yes 176/403 ... yes 176/404 ... yes 37/407 ... yes 118/408 ... yes 100/409 ... yes 175/410 ... yes 13/411 ... yes 41/412 ... yes 100/413 ... yes 116/414 ... yes 2/415 ... yes 275/416 ... yes 47/417 ... yes 221/418 ... yes 276/419 ... yes 212/420 ... yes 275/421 ... yes 277/422 ... yes 211/423 ... yes 37/424 ... yes 37/425 ... yes 223/426 ... yes 54/427 ... yes 54/428 ... yes 54/429 ... yes 17/430 ... yes 17/431 ... yes 17/432 ... yes 192/433 ... yes 100/434 ... yes 45/436 ... yes 263/437 ... yes 286/438 ... yes 286/439 ... yes 22/441 ... yes 287/442 ... yes 319/444 ... yes 10/445 ... yes 290/447 ... yes 287/448 ... yes 193/449 ... yes 54/450 ... yes 54/451 ... yes 54/452 ... yes 52/453 ... yes 5/454 ... yes 5/455 ... yes 287/459 ... yes 192/460 ... yes 37/461 ... yes 249/462 ... yes 116/463 ... yes 287/464 ... yes 10/465 ... yes 308/466 ... yes 287/468 ... yes 319/469 ... yes 308/471 ... yes 319/472 ... yes 5/473 ... yes 308/474 ... yes 5/475 ... yes 80/476 ... yes 270/479 ... yes 80/480 ... yes 17/481 ... yes 37/483 ... yes 315/484 ... yes 287/485 ... yes 287/486 ... yes 248/487 ... yes 405/488 ... yes 318/489 ... yes 319/490 ... yes 266/491 ... yes 50/492 ... yes 10/493 ... yes 316/494 ... yes 37/495 ... yes 80/497 ... yes 287/498 ... yes 318/500 ... yes 318/501 ... yes 37/502 ... yes 52/503 ... yes 324/504 ... yes 37/505 ... yes 13/506 ... yes 324/507 ... yes 140/509 ... yes 176/510 ... yes 285/512 ... yes 87/513 ... yes 80/515 ... yes 226/517 ... yes 226/518 ... yes 226/519 ... yes 226/520 ... yes 192/521 ... yes 80/522 ... yes 2/523 ... yes 52/524 ... yes 308/525 ... yes 229/528 ... yes 270/531 ... yes 140/532 ... yes 157/533 ... yes 307/534 ... yes 17/535 ... yes 157/536 ... yes 37/537 ... yes 80/538 ... yes 336/539 ... yes 308/540 ... yes 339/541 ... yes 237/542 ... yes 37/543 ... yes 339/544 ... yes 337/545 ... yes 5/546 ... yes 270/547 ... yes 337/548 ... yes 80/550 ... yes 141/551 ... yes 309/552 ... yes 336/553 ... yes 339/554 ... yes 2/555 ... yes 80/556 ... yes 339/557 ... yes 342/558 ... yes 289/559 ... yes 289/560 ... yes 289/562 ... yes 289/563 ... yes 289/564 ... yes 342/565 ... yes 289/566 ... yes 342/567 ... yes 80/568 ... yes 225/569 ... yes 289/570 ... yes 342/571 ... yes 54/572 ... yes 37/574 ... yes 118/576 ... yes 342/579 ... yes 359/580 ... yes 351/581 ... yes 351/582 ... yes 342/583 ... yes 210/584 ... yes 351/585 ... yes 351/586 ... yes 289/587 ... yes 289/588 ... yes 289/589 ... yes 270/591 ... yes 10/592 ... yes 351/593 ... yes 13/594 ... yes 359/595 ... yes 352/596 ... yes 359/597 ... yes 359/598 ... yes 357/600 ... yes 237/602 ... yes 351/604 ... yes 336/605 ... yes 226/606 ... yes 308/607 ... yes 80/608 ... yes 357/609 ... yes 365/610 ... yes 290/612 ... yes 351/613 ... yes 52/615 ... yes 357/616 ... yes 37/617 ... yes 332/618 ... yes 4/619 ... yes 289/621 ... yes 223/622 ... yes 332/623 ... yes 249/624 ... yes 336/629 ... yes 228/631 ... yes 172/632 ... yes 324/633 ... yes 375/635 ... yes 375/636 ... yes 342/637 ... yes 172/638 ... yes 80/639 ... yes 80/640 ... yes 80/641 ... yes 342/642 ... yes 249/643 ... yes 332/644 ... yes 332/645 ... yes 49/646 ... yes 192/647 ... yes 179/648 ... yes 369/649 ... yes 157/650 ... yes 308/651 ... yes 221/652 ... yes 179/654 ... yes 332/655 ... yes 308/656 ... yes 342/657 ... yes 378/658 ... yes 2/659 ... yes 290/660 ... yes 290/661 ... yes 2/662 ... yes 381/663 ... yes 221/664 ... yes 381/665 ... yes 12/666 ... yes 5/667 ... yes 383/671 ... yes 372/672 ... yes 80/673 ... yes 270/674 ... yes 229/675 ... yes 401/676 ... yes 394/677 ... yes 4/678 ... yes 289/679 ... yes 308/680 ... yes 52/681 ... yes 336/683 ... yes 398/684 ... yes 403/685 ... yes 403/686 ... yes 403/687 ... yes 80/688 ... yes 407/689 ... yes 407/690 ... yes 407/691 ... yes 405/692 ... yes 405/693 ... yes 120/695 ... yes 132/696 ... yes 120/697 ... yes 120/698 ... yes 401/699 ... yes 401/700 ... yes 398/701 ... yes 192/703 ... yes 270/705 ... yes 120/706 ... yes 120/707 ... yes 100/708 ... yes 192/709 ... yes 359/710 ... yes 415/711 ... yes 221/713 ... yes 37/714 ... yes 417/715 ... yes 80/716 ... yes 37/717 ... yes 418/718 ... yes 100/719 ... yes 324/720 ... yes 18/721 ... yes 342/722 ... yes 309/723 ... yes 332/724 ... yes 80/725 ... yes 383/726 ... yes 383/727 ... yes 148/728 ... yes 289/729 ... yes 383/730 ... yes 383/731 ... yes 192/734 ... yes 172/737 ... yes 229/738 ... yes 229/739 ... yes 229/740 ... yes 229/741 ... yes 229/742 ... yes 229/743 ... yes 37/745 ... yes 5/746 ... yes 428/747 ... yes 369/749 ... yes 270/750 ... yes 252/751 ... yes 351/752 ... yes 270/754 ... yes 179/755 ... yes 120/756 ... yes 263/758 ... yes 263/759 ... yes 192/760 ... yes 359/761 ... yes 332/762 ... yes 26/763 ... yes 54/765 ... yes 54/766 ... yes 383/767 ... yes 270/768 ... yes 439/769 ... yes 308/770 ... yes 308/771 ... yes 359/772 ... yes 237/773 ... yes 270/774 ... yes 441/775 ... yes 441/776 ... yes 441/777 ... yes 441/778 ... yes 441/779 ... yes 116/780 ... yes 37/783 ... yes 92/784 ... yes 390/785 ... yes 444/786 ... yes 444/787 ... yes 441/788 ... yes 441/789 ... yes 447/790 ... yes 10/793 ... yes 308/794 ... yes 49/795 ... yes 450/796 ... yes 450/797 ... yes 92/798 ... yes 308/799 ... yes 308/800 ... yes 342/801 ... yes 452/802 ... yes 450/804 ... yes 342/805 ... yes 453/806 ... yes 394/807 ... yes 453/808 ... yes 26/809 ... yes 140/811 ... yes 80/812 ... yes 142/813 ... yes 390/814 ... yes 8/815 ... yes 450/816 ... yes 307/817 ... yes 72/818 ... yes 252/819 ... yes 227/820 ... yes 447/821 ... yes 450/822 ... yes 47/823 ... yes 336/824 ... yes 453/825 ... yes 342/826 ... yes 49/827 ... yes 285/829 ... yes 457/830 ... yes 464/832 ... yes 468/833 ... yes 464/834 ... yes 450/835 ... yes 359/836 ... yes 176/837 ... yes Redis version >= 2.8.0? ... yes Ruby version >= 2.5.3 ? ... yes (2.6.3) Git version >= 2.21.0 ? ... yes (2.21.0) Git user has default SSH configuration? ... yes Active users: ... 335
Checking GitLab App ... Finished
Checking GitLab subtasks ... Finished