From 9e1ff8819592dd6ad168b1c16441f13961e2b789 Mon Sep 17 00:00:00 2001
From: Qiu Jian <qiujian@yunionyun.com>
Date: Mon, 7 Sep 2020 18:23:21 +0800
Subject: [PATCH] fix: prevent users in disabled idp from login

---
 pkg/keystone/tokens/auth.go | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkg/keystone/tokens/auth.go b/pkg/keystone/tokens/auth.go
index e34c8d8213..89bd49abb5 100644
--- a/pkg/keystone/tokens/auth.go
+++ b/pkg/keystone/tokens/auth.go
@@ -17,7 +17,6 @@ package tokens
 import (
 	"context"
 	"database/sql"
-	"fmt"
 	"time"
 
 	"yunion.io/x/jsonutils"
@@ -152,8 +151,12 @@ func authUserByIdentity(ctx context.Context, ident mcclient.SAuthenticationIdent
 
 	idp := idpObj.(*models.SIdentityProvider)
 
+	if idp.Enabled.IsFalse() {
+		return nil, errors.Wrap(httperrors.ErrInvalidStatus, "idp disabled")
+	}
+
 	if idp.Status != api.IdentityDriverStatusConnected && idp.Status != api.IdentityDriverStatusDisconnected {
-		return nil, errors.Error(fmt.Sprintf("invalid idp status %s", idp.Status))
+		return nil, errors.Wrapf(httperrors.ErrInvalidStatus, "invalid idp status %s", idp.Status)
 	}
 
 	conf, err := models.GetConfigs(idp, true, nil, nil)