mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-02-08 03:09:39 +03:00
Deny Logins with SAML #3511
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @dslater82 on GitHub (Feb 16, 2023).
Attempted Debugging
Searched GitHub Issues
Describe the Scenario
I have a bookstack instance setup with SAML. Is there a way to deny logins if they do not have an account in bookstack? We have 60,000 users who can login with SAML and don't want user's we don't specify to login. It seems we can do this if using one of the other authentication methods by settings XXXX_AUTO_REGISTER=false. We have another instance using ldap and I am able to get around this issue by doing
LDAP_USER_FILTER=(&(uid=${user})(memberOf=cn=group_name,ou=group,dc=XXXX,dc=XXXXX,dc=XXXXX))
Exact BookStack Version
23.01.1
Log Content
No response
PHP Version
No response
Hosting Environment
Rocky Linux 8 with PHP 8.2.
@ssddanbrown commented on GitHub (Feb 16, 2023):
Yeah, there's no built-in BookStack-side filtering or registration disabling for SAML authentication.
From my experience of playing with SAML platforms for testing, it's common for SAML auth platforms themselves to manage access control to the service provider (in this case BookStack).
You could technically block new registrations via restricting registration email domain (To a random non-used email domain), but that may have implications for existing users and when adding new users.
@dslater82 commented on GitHub (Feb 16, 2023):
Thanks. It seems the restriction email domain works. Admins had the user manually with the correct email and then they can login. Not ideal but it works.