feat: OAuth self-registration independent of general registration + OAuth-force-only mode#8506
Closed
ripgtxgt wants to merge 1 commit intocoollabsio:nextfrom
Closed
feat: OAuth self-registration independent of general registration + OAuth-force-only mode#8506ripgtxgt wants to merge 1 commit intocoollabsio:nextfrom
ripgtxgt wants to merge 1 commit intocoollabsio:nextfrom
Conversation
…oollabsio#8042) Feature 1 — OAuth self-registration independent of general registration ----------------------------------------------------------------------- Adds a new instance setting `is_oauth_registration_enabled` (default: true, preserving existing behaviour). When enabled, new users can create accounts by signing in via any configured OAuth provider even if the general self-registration toggle (`is_registration_enabled`) is off. Use case: disable password-based sign-up while letting trusted identity providers (Authentik, GitHub org, Google Workspace, etc.) onboard users. Logic in OauthController::callback(): new user allowed if is_oauth_registration_enabled OR is_registration_enabled Feature 2 — OAuth-force-only mode ---------------------------------- Adds a new instance setting `oauth_force_only` (default: false). When enabled, any user who authenticates via OAuth is flagged with a per-user `users.oauth_force_only = true` column. Subsequent password-based login attempts for that user are silently rejected in the Fortify authentication callback — they must sign in via their OAuth provider. This lets admins revoke access by disabling the account in the identity provider (e.g. remove from Authentik group, remove from GitHub org). Files changed ------------- database/migrations/ 2026_02_20_000001_add_oauth_registration_settings_to_instance_settings.php — adds is_oauth_registration_enabled + oauth_force_only to instance_settings 2026_02_20_000002_add_oauth_force_only_to_users_table.php — adds oauth_force_only (boolean, default false) to users app/Models/InstanceSettings.php — boolean casts for new columns app/Models/User.php — boolean cast for oauth_force_only app/Http/Controllers/OauthController.php — callback() uses is_oauth_registration_enabled for new-user gate — sets user.oauth_force_only when instance flag is on app/Providers/FortifyServiceProvider.php — authenticateUsing() returns null (= auth failure) for oauth_force_only users app/Livewire/Settings/Advanced.php — exposes + persists both new settings resources/views/livewire/settings/advanced.blade.php — two new toggle checkboxes with descriptive helper text Closes coollabsio#8042
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
Two new admin settings (Settings → Advanced):
1. OAuth Self-Registration Allowed (
is_oauth_registration_enabled, defaulttrue)Allows new users to register via OAuth providers even when general password registration is disabled. Use case: restrict signup to users in your Authentik/GitHub org without disabling OAuth entirely.
Logic: new user allowed if
is_oauth_registration_enabledORis_registration_enabled.2. Require OAuth Login (
oauth_force_only, defaultfalse)When enabled, users who sign in via OAuth are flagged
users.oauth_force_only = true. Subsequent password login attempts for that user are rejected in Fortify's auth callback. Use case: suspend access by removing the user from your identity provider.Issues
Category
AI Usage
Steps to Test
Contributor Agreement
Important