# Bug OP-13431 - Unexpected default value for limit_self_registration option of omniauth providers

Project: OpenProject
Status: closed
URL: https://community.openproject.org/work_packages/OP-13431

## Open points

_No work packages_

## Details

| Attribute | Value |
| --- | --- |
| Date |  |
| Priority | Medium |
| Module |  |
| Target versions | 13.1.0 |
| Observed in versions |  |
| Sprint | 13.1.0 |
| Backlog bucket |  |
| Bug found in version (deprecated) |  |
| Found in mobile app version |  |
| Follow-up feedback e-mail |  |
| Requires doc change | Yes |
| Accessibility | No |
| Pull preview |  |
| List |  |
| Labels |  |

## People

| Attribute | Value |
| --- | --- |
| Assignee |  |
| Accountable |  |
| Product manager |  |
| Developers |  |
| Designer |  |
| Ordered by |  |
| Signed off by |  |
| Interest by |  |

## Planning

| Attribute | Value |
| --- | --- |
| Relevance |  |

## Costs

| Attribute | Value |
| --- | --- |
| Votes |  |
| Work |  |
| Labor costs |  |

## Description

### Before filing a report

### Steps to reproduce

1.  Have OpenProject 12 with SSO via OpenID Connect or SAML configured
2.  Set self registration (under Administration -\> Authentication) to disabled to forbid the self registration of users via SSO
3.  Update to OpenProject 13
4.  Try to self register via SSO

### What is the buggy behavior?

It's arguable if this is a bug. One could argue that the default behaviour is unexpected and more dangerous than the other option because it allows users to self register when they couldn't before. Even if admins would expect this to be the other way around the worst that can happen there is that users can't register themselves whereas now people may gain access when this is unexpected.

  - users are able to self register

### What is the expected behavior?

  - users should not be able to self register

### Important

The thing with changing the default behaviour is that admins cannot easily change the option for SAML. We only offer a user interface for OpenID Connect where one can change the limit\_self\_registration setting for an OpenID Connect provider.

People who are using SAML may indeed often want the default behaviour to be that user scan self-register. But since there is no UI to change the setting - and even on the console it's not trivial to do so - this will cause support cases no matter which default we choose.

So perhaps the solution here is to offer a UI for SAML to allow changing at least the limit\_self\_registration setting. Ideally this would be used as a segue to offer a complete SAML user interface even if it's just a MVP of sorts.

**SAML**

The the record, the way to change this for SAML is the following.

First start a rails console via `sudo openproject run console` or equivalent.  
Then in this console run the following.

``` ruby
config = Setting.plugin_openproject_auth_saml
config["providers"]["saml"]["limit_self_registration"] = true
Setting.plugin_openproject_auth_saml = config
exit
```