Fix LDAP/OAuth2 users getting role reset on login #55

Merged

qwc merged 1 commit from fix/ldap-oauth2-role-reset into main

2026-02-09 17:40:04 +01:00

qwc commented

2026-02-09 17:16:19 +01:00

Owner

Summary

Preserve manually-assigned roles for existing LDAP and OAuth2 users on subsequent logins
Only set role from group membership during initial user provisioning
Continue syncing email changes for existing users

Fixes #54

Changes

internal/auth/ldap.go: Modified provisionUser() to only update email, not role
internal/auth/oauth2.go: Same change for OAuth2 authenticator
Updated corresponding tests to reflect new expected behavior

Test plan

Run go test -mod=vendor -count=1 ./internal/auth/... - all tests pass
Manual test: LDAP user logs in for first time → gets role from LDAP group
Manual test: Admin changes user's role in admin panel
Manual test: User logs in again via LDAP → role remains unchanged

🤖 Generated with Claude Code

## Summary - Preserve manually-assigned roles for existing LDAP and OAuth2 users on subsequent logins - Only set role from group membership during initial user provisioning - Continue syncing email changes for existing users Fixes #54 ## Changes - `internal/auth/ldap.go`: Modified `provisionUser()` to only update email, not role - `internal/auth/oauth2.go`: Same change for OAuth2 authenticator - Updated corresponding tests to reflect new expected behavior ## Test plan - [ ] Run `go test -mod=vendor -count=1 ./internal/auth/...` - all tests pass - [ ] Manual test: LDAP user logs in for first time → gets role from LDAP group - [ ] Manual test: Admin changes user's role in admin panel - [ ] Manual test: User logs in again via LDAP → role remains unchanged 🤖 Generated with [Claude Code](https://claude.com/claude-code)

qwc added 1 commit

2026-02-09 17:16:19 +01:00

Fix LDAP/OAuth2 users getting role reset on login

CI / test (pull_request) Successful in 1m8s

Details

CI / build (pull_request) Successful in 51s

Details

CI / docker (pull_request) Has been skipped

Details

3294f6333b

Preserve manually-assigned roles for existing LDAP and OAuth2 users.
Previously, provisionUser() would overwrite the user's role with the
group-derived role on every login, discarding any manual changes made
by admins. Now roles are only set during initial user creation.

Email synchronization continues to work for existing users.

Fixes #54

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>