Single sign-on links by email address by default #892

New issue

Closed

opened 2026-10-10 17:25:16 +00:00 by tiagoagueda · 0 comments

tiagoagueda commented

2026-10-10 17:25:16 +00:00

Owner

POSTULO_OIDC_LINK_BY_EMAIL defaults to on (config/settings/base.py:350-352), so once a provider is configured it signs somebody into the local account holding the address it asserts. #730 makes that match only an account that has verified the address. The remaining weakness is the default: on an instance paired with a weak provider (one that marks any typed address verified), every local account is one login away.

What exists today

The documentation explains the risk and the switch (Accounts-and-invitations.md, Sign-in methods); the dangerous value is the default, chosen so instances already running do not change behaviour.
The switch only matters once SOCIALACCOUNT_PROVIDERS names a provider, so every instance without one is unaffected either way.

What would change

The default becomes off; an operator who trusts their provider sets POSTULO_OIDC_LINK_BY_EMAIL=true.
A changelog line under Changed telling operators with a provider to set it to keep today's behaviour, and a startup warning (the checks framework) on an instance that has a provider and the variable unset.

Decisions

Which release. A breaking change for instances paired with a provider; recommended the next minor release, with the warning one release earlier if that is possible.

Found while fixing #730 (checked against main at 8c3d03570 plus that fix).

`POSTULO_OIDC_LINK_BY_EMAIL` defaults to on (`config/settings/base.py:350-352`), so once a provider is configured it signs somebody into the local account holding the address it asserts. #730 makes that match only an account that has *verified* the address. The remaining weakness is the default: on an instance paired with a weak provider (one that marks any typed address verified), every local account is one login away. ## What exists today - The documentation explains the risk and the switch (`Accounts-and-invitations.md`, *Sign-in methods*); the dangerous value is the default, chosen so instances already running do not change behaviour. - The switch only matters once `SOCIALACCOUNT_PROVIDERS` names a provider, so every instance without one is unaffected either way. ## What would change - The default becomes off; an operator who trusts their provider sets `POSTULO_OIDC_LINK_BY_EMAIL=true`. - A changelog line under *Changed* telling operators with a provider to set it to keep today's behaviour, and a startup warning (the checks framework) on an instance that has a provider and the variable unset. ## Decisions - **Which release.** A breaking change for instances paired with a provider; recommended the next minor release, with the warning one release earlier if that is possible. Found while fixing #730 (checked against `main` at `8c3d03570` plus that fix).

tiagoagueda added this to the 0.6.0 milestone

2026-10-10 17:25:16 +00:00

tiagoagueda added the

labels

2026-10-10 17:25:16 +00:00

tiagoagueda self-assigned this

2026-10-10 17:48:34 +00:00

tiagoagueda referenced this issue from a commit