User is prompted to reset their password when logging in with OAuth provider

[wreiske]

Description:

User is prompted to reset their password when logging in with OAuth provider

Steps to reproduce:

1. Setup OAuth like GitHub or Google
2. Have an account that already exists and is verified (this could be from a previous OAuth login predating version 3.3.0, or a manually created account, or an LDAP synced account)
3. Try to login with OAuth

Expected behavior:

Log in without issue.

Actual behavior:

Users are being prompted that the email is duplicated and is not verified. They are required to reset their password even when we have password resets disabled. If they try to type in their current correct password, it shows the password can't be changed.

Server Setup Information:

• Version of Rocket.Chat Server: Issue has been seen on 3.0.3 (ef1e0b3) and 3.3.0 (a987295)

Additional Information

[wreiske]

IMO if the allow password change setting is OFF, there's probably a good reason for it, and the user should never be able to change their password in Rocket.Chat.

It should maybe prompt the user to contact their administrator to unlock their account, or it should refuse to allow the user to log-in at all if the email isn't verified. It looks like possibly it logs the user in but keeps them on that screen. They may be able to see incoming messages, use "Router.go" to change their route to a DM, etc.

[pierre-lehnen-rc]

The feature exists to protect the user in case someone tried to use their email in the past. In that case when they log in through OAuth they will be taking over the account that used their email and by changing the password they'll me locking out the old user.