Skip to content

A server with GOTIFY_LOCALAUTH_ENABLED=false set still allows the user to attempt to change their password #1040

Description

@parnic

Can the issue be reproduced with the latest available release? (y/n)
y

Which one is the environment gotify server is running in?

  • Docker
  • Linux machine
  • Windows machine
Docker startup command or config file here (please mask sensitive information)
services:
  gotify:
    image: ghcr.io/gotify/server:3.1.0
    container_name: gotify
    ports:
      - 8280:80
    volumes:
      - data:/app/data
    restart: unless-stopped
    logging:
      driver: local
    environment:
      GOTIFY_OIDC_ENABLED: "true"
      GOTIFY_OIDC_ISSUER: https://redacted.com
      GOTIFY_OIDC_CLIENTID: redacted
      GOTIFY_OIDC_CLIENTSECRET: ${GOTIFY_OIDC_CLIENTSECRET}
      GOTIFY_OIDC_LINK_BY_USERNAME: "true"
      GOTIFY_OIDC_REDIRECTURL: https://redacted.com/auth/oidc/callback
      GOTIFY_LOCALAUTH_ENABLED: "false"
      GOTIFY_OIDC_SCOPES: openid,profile,email,groups
      GOTIFY_OIDC_GROUPS_CLAIM: groups
      GOTIFY_OIDC_GROUPS_USER: gotify-user
      GOTIFY_OIDC_GROUPS_ADMIN: gotify-admin
      GOTIFY_OIDC_IDP_NAME: PocketID
      GOTIFY_OIDC_AUTO_REDIRECT: "true"

volumes:
  data:

Do you have an reverse proxy installed in front of gotify server? (Please select None if the problem can be reproduced without the presense of a reverse proxy)

  • None
  • Nginx
  • Apache
  • Caddy
Reverse proxy configuration (please mask sensitive information)
n/a to this issue, reverse proxy is working fine

On which client do you experience problems? (Select as many as you can see)

  • WebUI
  • gotify-cli
  • Android Client
  • 3rd-party API call (Please include your code)

What did you do?
The user can click on their username to get a "Change password" prompt when GOTIFY_LOCALAUTH_ENABLED is set to false. This is not causing an issue directly (I haven't actually tried to change my password) but it's confusing because the documentation says you can't use passwords when local auth is diabled.

What did you expect to see?
No "change password" prompt

What did you see instead? (Include screenshots, android logcat/request dumps if possible)
A "change password" prompt

Metadata

Metadata

Assignees

No one assigned

    Labels

    a:bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions