Issue creating users with the gitlab API

Hi,

When setting up a registration script that uses the gitlab API to create gitlab user accounts, I'm running into the folowing issue:

When I POST the request with the required parameters (email, name, username, password), two mails are sent: First mail:

Subject: Confirmation instructions
Body:
Welcome Your name here!
 
You can confirm your account through the link below:
 
Confirm my account[1]

Second mail:

Subject: Account was created for you
Body:
Hi Your name here!
 
The Administrator created an account for you. Now you are a member of the company GitLab application.
 
login.......................................... john.doe@example.com
 
—
View it on GitLab[2]

When John Doe in this example, follows the first confirmation link, he'll see a flash message:

Your account was successfully confirmed. You are now signed in.

From there, he can't change his password. Because he doesn't know his password.

To get John to work with gitlab. He should:

1. logout.
2. Navigate to the standard login form (we have ldap enabled and that login form is displayed on top)
3. click "Forgot your password?"
4. fill in his mail address
5. check mail
6. click the "Change my password" link in the mail.
7. Then set his password.

This is quite a contrast compared to an account created by an admin user in the UI:

1. Hit the "New User" button in the user overview
2. fill in: name, username, email and hit create user
3. the user gets an email with subject: "Account was created for you", the mail contains a link set a password

Ideally, you want to have the password field optional in the user create api call. If the password is omitted, the newly create user should receive just one mail, just like when done manually through the UI.

Seems like a bug to me. All functionality seems to be there, but it looks like the wrong action is triggered.

Using the latest (7.7.1) omnibus install.

Bests,

Bram

I would very much appreciate the described behavior for the API as well. It should not require a password to be given/set. If it is not given the user should get an email with a reset/set link for his new account.

mentioned in issue #989 (closed)

Mmmm....

this issue is not mentioned in issue 989. Issue 989 refers to a merge request with the same number.

Removed ~14281 label

Hi @brammeleman, do you still experience this issue?

Added ~65372 label

Hi @rymai, Yes. It's roughly the same thing going on in gitlab 8.12.3.

Steps:

1. api call

   TOKEN=mysecrettoken
   curl  --header "PRIVATE-TOKEN: $TOKEN" -X POST  "https://gitlab.example.com/api/v3/users?email=testlogin@example.com&password=secretepasswd&username=testlogin&name=testlogin"

2. one new mail! Subject: Confirmation instructions
3. click Confirm your account link in the email
4. the user is now in a gitlab session, but doesn't know the password and can't change the password
5. logout
6. visit Forgot your password?
7. ... etc...

I still think the password parameter in the users API should be made optional:

• email (required) - Email
• password (required) - Password
• username (required) - Username
• name (required) - Name

Cheers,

Bram

Thanks @brammeleman!

Added feature proposal ~131895 and removed ~65372 notifications labels

added ~123454 label

removed ~131895 label

mentioned in merge request !8957 (merged)

In !8957 (merged) I've added a reset_password parameter, making either password or reset_password required instead of password. Rather than simply sending reset emails when the password is omitted or left blank, this explicit parameter protects people calling the API from accidentally sending out emails unexpectedly (i.e. like with confirm, the default is to not send out any email).

added user management label

@joostrijneveld Great! Thanks for implementing this feature! Groet, Bram

closed via merge request !8957 (merged)

mentioned in merge request !14785