{"record":{"id":"f6ed81dc8c3d6d52","repo":"theonedev/onedev","slug":"email-address-0-used-by-disabled-account-1","errorCode":null,"errorMessage":"Email address \"{0}\" used by disabled account \"{1}\"","messagePattern":"Email address \"(.+?)\" used by disabled account \"(.+?)\"","errorType":"exception","errorClass":"AuthenticationException","httpStatus":401,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/web/page/security/SsoProcessPage.java","lineNumber":184,"sourceCode":"\t\t\t\t\t\t\t\t\tuser.addEmailAddress(emailAddress);\n\t\t\t\t\t\t\t\t\temailAddressService.update(emailAddress);\n\t\t\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t\t\tthrow new AuthenticationException(MessageFormat.format(_T(\"Email address \\\"{0}\\\" used by account \\\"{1}\\\"\"), authenticated.getEmail(), user.getName()));\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tsyncGroupsAndSshKeys(user, false);\n\t\t\t\t\t\t\treturn user;\n\t\t\t\t\t\t}\n\t\t\t\t\t} \n\t\t\t\t\tif (authenticated.getEmail() != null) {\n\t\t\t\t\t\tvar emailAddress = emailAddressService.findByValue(authenticated.getEmail());\n\t\t\t\t\t\tif (emailAddress != null) {\n\t\t\t\t\t\t\tvar user = emailAddress.getOwner();\n\t\t\t\t\t\t\tif (emailAddress.isVerified()) {\n\t\t\t\t\t\t\t\tif (user.getType() != ORDINARY) {\n\t\t\t\t\t\t\t\t\temailAddressService.delete(emailAddress);\n\t\t\t\t\t\t\t\t} else if (user.isDisabled()) {\n\t\t\t\t\t\t\t\t\tthrow new AuthenticationException(MessageFormat.format(_T(\"Email address \\\"{0}\\\" used by disabled account \\\"{1}\\\"\"), authenticated.getEmail(), user.getName()));\n\t\t\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t\t\tssoAccount = new SsoAccount();\n\t\t\t\t\t\t\t\t\tssoAccount.setUser(user);\n\t\t\t\t\t\t\t\t\tssoAccount.setProvider(getProvider());\n\t\t\t\t\t\t\t\t\tssoAccount.setSubject(authenticated.getSubject());\n\t\t\t\t\t\t\t\t\tssoAccountService.create(ssoAccount);\n\n\t\t\t\t\t\t\t\t\tsyncGroupsAndSshKeys(user, false);\n\t\t\t\t\t\t\t\t\treturn user;\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t\temailAddressService.delete(emailAddress);\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t} \n\t\t\t\t\t}\n\t\t\t\t\treturn null;\n\t\t\t\t});\n\t\t\t\tif (aUser != null) ","sourceCodeStart":166,"sourceCodeEnd":202,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/web/page/security/SsoProcessPage.java#L166-L202","documentation":"During SSO login, if the verified email from the identity provider belongs to an ordinary user whose account is disabled, OneDev refuses to authenticate, telling you the email is used by a disabled account. This prevents logging in through SSO while the matching local account is deactivated.","triggerScenarios":"SSO callback resolves authenticated.getEmail() to a verified email whose owner is an ORDINARY user with user.isDisabled() == true (SsoProcessPage.java:184).","commonSituations":"A user was disabled/deactivated (e.g. offboarding, license trimming, manual disable) but still has an active account in the identity provider and clicks the SSO login button; LDAP/SSO sync re-enables the IdP side but OneDev account stays disabled.","solutions":["Re-enable the user account in OneDev (Admin > Users, uncheck Disabled) if access should be restored.","If the user should not have access, remove or deactivate them in the identity provider so they can't attempt SSO.","Change the verified email on the disabled OneDev account if the email now legitimately belongs to someone else."],"exampleFix":"// Admin: re-enable account\nUPDATE user SET disabled = false WHERE name = 'john';\n// or via UI: Admin -> Users -> john -> uncheck 'Disabled'","handlingStrategy":"validation","validationCode":"// Check the matching account is active before SSO login\nvar ea = OneDev.getInstance(EmailAddressService.class).findByEmailAddress(email);\nif (ea != null && ea.isVerified() && ea.getOwner().isDisabled())\n    // account disabled: do not attempt SSO, restore access first","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep OneDev account enable/disable state in sync with the identity provider (SCIM/LDAP sync).","When offboarding, disable the user in both OneDev and the IdP together.","Regularly audit disabled accounts that still exist in the IdP."],"tags":["sso","disabled-account","authentication"],"backgroundTag":"account-disabled","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}