Accounts and sign-in

Arbinel changes how sign-in works for people who use more than one account and for apps that sign users in through the instance. Everything else about accounts works as described in Forgejo’s documentation.

Linked accounts after an OAuth2 sign-up

When you sign up through an external OAuth2 provider, such as GitHub, Codeberg or GitLab, Arbinel links that provider account to your new account. It shows under Settings → Security → Linked accounts, like a provider you link later. Forgejo does not create this link, so the list stays empty for accounts that signed up through a provider (forgejo#11857).

The link is created only for new sign-ups. Accounts that signed up through a provider before the change do not get one.

Selecting Remove on the provider you signed up with also stops you from signing in through that provider, and your account becomes a local account. Arbinel refuses this when the account has no password and no link to another provider, because you would have no way to sign in. Set a password first, under Settings → Account, and then remove the link.

Switch between accounts

The account switcher lets you stay signed in to several accounts in one browser, such as your own account and a bot account, and move between them without signing out.

1. Open the user menu in the top right corner.
2. Select Add an account and sign in to the other account, including its two-factor step if it has one. You can also sign in through an OAuth2 provider.
3. Open the user menu again. Under Switch account, select the account you want to use.

When you switch, Arbinel reloads the current page as the other account, so you stay on the same page. Select the × next to an account, labelled Remove from this device, to drop it from the list. Sign out signs out of every account in the browser at once.

Arbinel keeps the list of accounts in your session on the server, so a browser can only switch to an account that signed in during that session. You cannot switch to a suspended or deactivated account, and Arbinel removes it from the list. The Remember me cookie follows the account you switch to.

Choose an account when an app signs you in

When an app uses Arbinel as its OAuth2 provider, it can ask you which account to continue with. The app adds prompt=select_account to the authorization request, as defined by OpenID Connect.

Arbinel then shows a page titled Choose an account for “<app>”, before the usual consent screen. It lists the account you are signed in with and the other accounts in your account switcher, each as Continue as <name>.

• Continue as <name> switches the browser to that account and continues the authorization as that account.
• Use another account starts Add an account, then returns to the app’s authorization.
• Cancel returns an access_denied error to the app.

Choosing an account switches the whole browser to it, not only the app. Other prompt values are ignored, as in Forgejo.

For app developers

Add select_account to the prompt query parameter of /login/oauth/authorize:

https://forge.example.com/login/oauth/authorize?client_id=...&redirect_uri=...&response_type=code&state=...&prompt=select_account

prompt can hold several space-separated values, and Arbinel shows the chooser when one of them is select_account. The client ID, redirect URI and PKCE checks run before the chooser, and fail the same way as without it. Use it for a “switch account” link in your app, so the user does not have to sign out of the forge first.

Consent screen

The consent screen asks Authorize “<app>” to access your account?. Forgejo always adds a warning that the app can “access and write to all your account information, including private repos and organizations”. Arbinel shows that warning only when the app does get full access.

Whether it does depends on the scope the app requests:

Requested scope	Token the app gets	Warning
No scope, or only openid, profile, email and groups	Full access to the account	Shown
Includes all	Full access to the account	Shown
API token scopes, such as read:user or public-only	Limited to those scopes	Hidden

Note

Forgejo’s OAuth2 provider page says that scopes are not implemented for OAuth2 tokens. That is out of date. Forgejo and Arbinel both limit an OAuth2 token to the API token scopes in the request, and give full access only when the request has none. An app that only needs to sign users in should request openid together with a narrow scope, such as read:user or public-only, so the token cannot do more.

Compared with Forgejo

• Signing up through an OAuth2 provider creates a linked account, and removing the link stops you from signing in through that provider.
• The account switcher and prompt=select_account do not exist in Forgejo.
• The full-access warning on the consent screen shows only for grants that get full access.