404 on repo URL

[agent-squirrel]

Description

We have a few users that are experiencing an issue when directly added as collaborators to a repo, they experience a 404 when navigating to the repo URL in the web interface. Also the repo does not appear under the user's explore listing.

We use LDAP to sync users into specific teams from AD. If the users are added to a team via this sync and then the entire team is added a repo, they are able to access it as normal.

If I remove the affected user(s) and then readd them, they can access the repo for a few days and then they receive a 404 again. Unfortunately I do not have the time frame for this as I neglected to record it, apologies.

Logs are attached, the first failure is on line 747 for the repo Flynns_Place. (There are some other references to the repo with 404 further up but the user was trying to access a branch that doesn't exist.)

app.ini gist is here: https://gist.github.com/agent-squirrel/bf0845f16bac306750d2279c12e257cc
I haven't scrubbed URLs from the gist since this is an internal only server.

In addition, SELinux is enabled but there are no alerts in the audit log.

Please let me know if you need any extra info. I appreciate the help.

Thanks

Gitea Version

1.22.2

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

https://gist.github.com/agent-squirrel/5dcb62ab56ac8167fcaab2371ced0e39

Screenshots

An example of what the affected users see on the explore page, note the missing repo Flynns_Place.

The 404 on the URL.

Collaborators page with an affected user directly added.

Git Version

2.43.5

Operating System

RHEL 8.10

How are you running Gitea?

We are using a binary install using systemd.

Database

MySQL/MariaDB

[lunny]

Can you post your LDAP configurations without sensitive information?

[agent-squirrel]

Sure here you go: https://gist.github.com/agent-squirrel/e464ee903478cc887476e5efa4484c66
If you'd prefer screenshots I can provide those.

I should also mention that the affected users are still listed as collaborators on the repo. They aren't removed by LDAP sync or anything.

[lunny]

The LDAP sync will sync groups and teams but looks like you added users as collaborators from your screenshots. Teams and Collaborators are different. I don't think LDAP sync will add user as collaborators.

[agent-squirrel]

@lunny I understand that. The problem is if you add a user as a collaborator manually to a repo, that user after a few days will lose access to the repo. They still show up as a collaborator but they get a 404 when trying to access it.

If we add the synced team containing the user everything works as it should.

[NikRusanov]

We got similar issue, if we add user in Collaborator with admin permissions and in LDAP team with read permissions, after few days user will only have teams permissions and Collaborator's ignore

[wxiaoguang]

We got similar issue, if we add user in Collaborator with admin permissions and in LDAP team with read permissions, after few days user will only have teams permissions and Collaborator's ignore

It is a bug, I think the buggy behavior should have been fixed in Fix team permission #34128