# Sign In Prohibited

**URL:** <https://forum.gitea.com/t/sign-in-prohibited/2516>\
**Category:** Gitea Usages\
**Created:** [September 23, 2020, 12:58pm UTC](https://forum.gitea.com/t/sign-in-prohibited/2516 "2020-09-23T12:58:32Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![hwg](https://avatars.discourse-cdn.com/v4/letter/h/8797f3/32.png) [@hwg](https://forum.gitea.com/u/hwg)\
**Post date:** [September 23, 2020, 12:58pm UTC](https://forum.gitea.com/t/sign-in-prohibited/2516/1 "2020-09-23T12:58:33Z")

</div>

**Sign In Prohibited**

**Your account is prohibited to sign in, please contact your site administrator.**

HI,  
I’m a bit mystified why I am all of a sudden getting this message when trying to log in. As far as I am aware I am authenticated correctly (ie. if I type an incorrect password I get a Username or password is incorrect. message). This via LDAP or local.  
In my postgres db prohibit\_login is set to false in the user table. Is there anywhere else I should be looking ?

Many Regards

Gitea Version: 1.13.0+dev-344-g4315e313d

---

<div class="post-metadata">

**Author:** ![zicklag](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.gitea.com/zicklag/32/140_2.png) [@zicklag](https://forum.gitea.com/u/zicklag)\
**Post date:** [September 28, 2020, 8:28pm UTC](https://forum.gitea.com/t/sign-in-prohibited/2516/2 "2020-09-28T20:28:34Z")

</div>

Hey I’m getting this too, interestingly enough. I’m using LDAP auth, and it obviously authenticates me because it shows who I am and actually signs me in. I haven’t changed anything since it worked last. At least that I know of.

Is there any way to recover login access, even if it’s by creating a new user that has admin or something manually?

---

<div class="post-metadata">

**Author:** ![zicklag](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.gitea.com/zicklag/32/140_2.png) [@zicklag](https://forum.gitea.com/u/zicklag)\
**Post date:** [September 28, 2020, 9:10pm UTC](https://forum.gitea.com/t/sign-in-prohibited/2516/3 "2020-09-28T21:10:04Z")

</div>

So I’m messing around with the database trying to figure out how to unlock the accounts and so far the only thing I’ve noticed is that if you set `prohibit_login` on the user in the `user` table, it will actually **stop** you from logging in, but the symptom that I notice right now is that you **do** login, it gets your avatar and your theme preferences even, but it doesn’t let you navigate to any pages without showing the prohibited page.

I’m using Gitea 1.9.

---

<div class="post-metadata">

**Author:** ![zicklag](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.gitea.com/zicklag/32/140_2.png) [@zicklag](https://forum.gitea.com/u/zicklag)\
**Post date:** [September 28, 2020, 9:35pm UTC](https://forum.gitea.com/t/sign-in-prohibited/2516/4 "2020-09-28T21:35:58Z")

</div>

Hey @hwg I just fixed it. 🙂

Somehow it appears that all of the user accounts were _deactivated_. If you check the `is_active` column in the database it is probably `0`. Just set that to `1` and it works. Now I’m not sure how the accounts ended up in this state, though. 😕 That’s a little concerning.

On my Sqlite database I just ran:

```auto
update users set is_active = 1;

```

That’s assuming you want to activate every user account.

---

<div class="post-metadata">

**Author:** ![hwg](https://avatars.discourse-cdn.com/v4/letter/h/8797f3/32.png) [@hwg](https://forum.gitea.com/u/hwg)\
**Post date:** [September 28, 2020, 10:25pm UTC](https://forum.gitea.com/t/sign-in-prohibited/2516/5 "2020-09-28T22:25:52Z")

</div>

Yeah that fixed it for me. I saw the is\_active field before and was sure I’d changed it but can only assume I did not commit it. Still I have no idea what deactivated the account. It had happened to one other account as well. Seems pretty random. Thanks for following up with this, saved me some grief.

---

<div class="post-metadata">

**Author:** ![zicklag](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.gitea.com/zicklag/32/140_2.png) [@zicklag](https://forum.gitea.com/u/zicklag)\
**Post date:** [September 28, 2020, 11:27pm UTC](https://forum.gitea.com/t/sign-in-prohibited/2516/6 "2020-09-28T23:27:49Z")

</div>

> [@hwg](#):
>
> It had happened to one other account as well.

Strangely it happened to all of my accounts. I’m completely clueless of what caused it. Something to keep an eye on.

---

<div class="post-metadata">

**Author:** ![hwg](https://avatars.discourse-cdn.com/v4/letter/h/8797f3/32.png) [@hwg](https://forum.gitea.com/u/hwg)\
**Post date:** [October 5, 2020, 6:21am UTC](https://forum.gitea.com/t/sign-in-prohibited/2516/7 "2020-10-05T06:21:11Z")

</div>

It has randomly happened to me again. No idea what has has triggered this. I hadn’t looked at it for a few days and it’s not in production yet. Perhaps inactivity ?

---

<div class="post-metadata">

**Author:** ![hwg](https://avatars.discourse-cdn.com/v4/letter/h/8797f3/32.png) [@hwg](https://forum.gitea.com/u/hwg)\
**Post date:** [October 5, 2020, 6:37am UTC](https://forum.gitea.com/t/sign-in-prohibited/2516/8 "2020-10-05T06:37:11Z")

</div>

Maybe this is related:

> <https://github.com/go-gitea/gitea/issues/4067>
>
> Gitea version (or commit ref): 1.4.1 built with: bindata, sqlite
> Git version: 2.11.0
> Operating system: Debian 9.4
> Database (use \[x\]):
> PostgreSQL
> MySQL
> MSSQL
> SQLite
> 
> Can...

I don’t seem to have logging set up very well and cannot see if that is the issue for me.

---

<div class="post-metadata">

**Author:** ![pizzacoca](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.gitea.com/pizzacoca/32/5015_2.png) [@pizzacoca](https://forum.gitea.com/u/pizzacoca)\
**Post date:** [November 3, 2021, 3:46pm UTC](https://forum.gitea.com/t/sign-in-prohibited/2516/9 "2021-11-03T15:46:22Z")

</div>

Hi,  
I am a very beginner on truenas & surprised to have to install sqlite3 twice on the jail to update user’s rights

```auto
pkg update
pkg install sqlite3
cd /usr/local/share/gitea/data
sqlite3 gitea.db

```

Then make the update

```auto
pdate user set is_active = 1;

```

---

<div class="post-metadata">

**Author:** ![Fermin](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.gitea.com/fermin/32/5040_2.png) [@Fermin](https://forum.gitea.com/u/Fermin)\
**Post date:** [February 15, 2022, 1:49pm UTC](https://forum.gitea.com/t/sign-in-prohibited/2516/10 "2022-02-15T13:49:12Z")

</div>

I think I just solved this. It turns out that the “Username Attribute” field is case sensitive and not at all optional. For Microsoft Active Directory, it has to be **sAMAccountName**.

Before this, every directory sync, either manual or scheduled, would deactivate the users. Also, the users would only start showing up on the Gitea user list after their first login.

My settings are as follows:

```auto
Authentication Type: LDAP (via BindDN)
Authentication Name: AD
Security Protocol: LDAPS
Host: corp.domain.com
Port: 636
Skip TLS Verify: >checked<
Bind DN: CN=LDAP read,OU=Users,OU=Administration,ou=root,DC=corp,DC=domain,DC=com
Bind Password: <encrypted...>
User Search Base: OU=Users,OU=Accounts,ou=root,DC=corp,DC=domain,DC=com
User Filter: (&(objectCategory=Person)(memberOf=CN=Git Users,OU=Roles,OU=Groups,OU=Accounts,ou=root,DC=corp,DC=domain,DC=com)(sAMAccountName=%s)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))
Admin Filter: (memberOf=CN=Git Admins,OU=Roles,OU=Groups,OU=Accounts,ou=root,DC=corp,DC=domain,DC=com)
Restricted Filter: <blank>
Username Attribute: sAMAccountName
First Name Attribute: givenName
Surname Attribute: sn
Email Attribute: mail
Public SSH Key Attribute: >blank<
Avatar Attribute: >blank<
Verify group membershipt in LDAP: >not checked<
Use Paged Search: >not checked< (might be a good idea for large environments, though)
Fetch Attributes in Bind DN Context: >not checked<
Skip local 2FA: >not checked<
Allow an empty search result to deactivate all users: >not checked<
Enable User Synchronization: >checked<
This Authentication Source is Activated: >checked<

```

Since I’ve fixed this the behaviour has changed. Not only are external user accounts no longer deactivated at every directory sync, but users that fulfill the criteria of the user filter are populated in the Gitea user directory right away - not only after their first login. So this might help as a hint that you solved it in your environments if the users are populated.

(edit: reformatted for better legibility)

---

<div class="post-metadata">

**Author:** ![diko](https://avatars.discourse-cdn.com/v4/letter/d/e95f7d/32.png) [@diko](https://forum.gitea.com/u/diko)\
**Post date:** [August 8, 2022, 7:10pm UTC](https://forum.gitea.com/t/sign-in-prohibited/2516/11 "2022-08-08T19:10:24Z")

</div>

I also had sync issues and found this post during my research. However, in my case the root cause was different. The setup in gitea was correct, but the missing part was lack of permissions for the Bind DN user account. The account I used there was only member of the default “Domain Users” group in my Active Directory. But that is not enough to read all attributes in AD (at least not anymore in newer versions of Windows Server OS - see here for more information: [Understanding the Risks of Pre-Windows 2000 Compatibility Settings in Windows 2022 | Semperis](https://www.semperis.com/blog/security-risks-pre-windows-2000-compatibility-windows-2022/))

To solve the issue in my case: I granted the Bind DN user account “Read all attributes” permission in the domain for “this object and all child objects”.  
Instead for the whole domain, it should be enought to grant permissions on the OU and subtree where all required user accounts are in.