Disable password confirmation when using SSO (reverse proxy) authentication

[kuklinistvan]

• Gitea version (or commit ref):
• Git version: 1.1.3
• Operating system: Arch Linux
• Database (use [x]):
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (provide example URL)
  • No
  • Not relevant
• Log gist: (?)

Description

I've set up a Gitea instance and configured it to authenticate users against mod_auth_kerb with these options to provide SSO service:

REVERSE_PROXY_AUTHENTICATION_USER = X-WEBAUTH-USER
ENABLE_REVERSE_PROXY_AUTHENTICATION    = true
ENABLE_REVERSE_PROXY_AUTO_REGISTRATION = true

In apache vhosts configuration:

...
        RequestHeader set X-WEBAUTH-USER expr=%{REMOTE_USER}
...

Now, as expected, I cannot use any functions that require password confirmation as my Gitea instance is not prepared to be aware of using this external authentication source. A solution would be to disable password confirmation, I guess. (had a similar issue with NextCloud)

Screenshots

[strk]

Same problem exists when using other password-less authentication means (OAuth2, OpenID). If I'm not wrong there's an open issue about dealing with that

[strk]

#1036 is the previous discussion ticket

[lafriks]

Closing as duplicate for #1036