From 121160449c2e7904bbbb43526bbad405a758f6f6 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 30 Oct 2026 05:48:37 +0000 Subject: [PATCH] Docs: a service account's name stays local only while local comes first The deployment guide said a service account's name is never forwarded to a credential-forwarding upstream. The realms are asked in priority order and the forwarding provider asks its upstream before any account lookup, so with a forwarding realm ahead of `local`, or `local` disabled, a login or Basic attempt as a service account sends its local part and the typed password upstream (and is still refused). The guide now qualifies the claim, for service accounts and for invited users, which it made too. Fixes #551 Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_012e6DJXRhLYxFjzrWiwKFKc --- docs/changes/2.2.0/551.docs.md | 6 ++++++ docs/deployment.md | 22 ++++++++++++++++------ 2 files changed, 22 insertions(+), 6 deletions(-) create mode 100644 docs/changes/2.2.0/551.docs.md diff --git a/docs/changes/2.2.0/551.docs.md b/docs/changes/2.2.0/551.docs.md new file mode 100644 index 00000000..b0a4bf5d --- /dev/null +++ b/docs/changes/2.2.0/551.docs.md @@ -0,0 +1,6 @@ +The deployment guide said a service account's name is never forwarded to a +credential-forwarding realm's upstream. That holds only while the `local` +realm is enabled and comes before every such realm: behind a forwarding +realm, a login or Basic attempt as a service account sends the local part of +its name and the typed password upstream, and is then refused. The guide now +says so, for service accounts and invited users. diff --git a/docs/deployment.md b/docs/deployment.md index cb4c0a51..0d069373 100644 --- a/docs/deployment.md +++ b/docs/deployment.md @@ -405,9 +405,10 @@ password, at least 12 characters, and then sign in. [access and sign-in settings](#access-and-sign-in-settings)). - **Until the user has chosen the password**, the account signs in by no path: the login and HTTP Basic refuse every password, nothing is forwarded - to a credential-forwarding realm, and an OIDC login does not link to it by - name. **Admin → Users** shows it as *invited*, or *invitation expired* once - its link no longer works. + to a credential-forwarding realm (while the `local` realm comes before it, + see [Service accounts](#service-accounts)), and an OIDC login does not + link to it by name. **Admin → Users** shows it as *invited*, or + *invitation expired* once its link no longer works. - **The user's page** offers **Resend invitation** (a new email, to another address if needed), **Copy invitation link** (a new link shown once, for an install without email or a mailbox that does not receive it) and **Revoke @@ -468,9 +469,18 @@ network that nobody signs in to. access level of reader or writer. - **It never has** a password, an invitation or an email address, and nobody signs in to it: the login screen, a password over HTTP Basic, - credential forwarding (its name is never forwarded upstream) and OIDC - (no identity is linked to it by name) all refuse it. **Sign out - everywhere**, invitations and the switch to a local account do not apply. + credential forwarding and OIDC (no identity is linked to it by name) all + refuse it. **Sign out everywhere**, invitations and the switch to a local + account do not apply. +- **Its name is not forwarded upstream while the `local` realm comes + first.** The realms are asked in the order **Admin → Authentication** + lists them, and `local` ends a password attempt as a service account + before any later realm sees it. A new realm is added after `local`, but + with a credential-forwarding realm moved ahead of it, or `local` disabled, + a login or Basic attempt as `ci@example.com` sends `ci` and the typed + password to that realm's upstream. The attempt is still refused, since + only the realm's own accounts sign in through it; the same holds for + local and invited accounts. - **It never holds the built-in `admin` role.** For admin automation, issue an administrator a token with the `admin` scope instead. - **It authenticates** with the API tokens an administrator issues on its