move setting to CustomerSSOProvider

src/pretix/api/serializers/organizer.py

@@ -570,7 +570,6 @@ class OrganizerSettingsSerializer(SettingsSerializer):
         # should not be included!
         'customer_accounts',
         'customer_accounts_native',
-        'customer_accounts_to_oidc',
         'customer_accounts_link_by_email',
         'customer_accounts_require_login_for_order_access',
         'invoice_regenerate_allowed',

src/pretix/base/models/customers.py

@@ -73,6 +73,13 @@ class CustomerSSOProvider(LoggedModel):
         null=False, blank=False,
         choices=METHODS,
     )
+    allow_convert_to_sso = models.BooleanField(
+        default=False,
+        verbose_name=_("Convert existing customers to single-sign-on accounts on login"),
+        help_text=_(
+            "If enabled, when an existing customer registered with email and password tries to login through this SSO provider, pretix changes the account to single-sign-on. Otherwise pretix does not allow to log in."
+        ),
+    ),
     configuration = models.JSONField()
 
     def allow_delete(self):

src/pretix/base/settings.py

@@ -181,19 +181,6 @@ DEFAULTS = {
             widget=forms.CheckboxInput(attrs={'data-display-dependency': '#id_settings-customer_accounts'}),
         )
     },
-    'customer_accounts_to_oidc': {
-        'default': 'False',
-        'type': bool,
-        'form_class': forms.BooleanField,
-        'serializer_class': serializers.BooleanField,
-        'form_kwargs': dict(
-            label=_("Convert existing customers to single-sign-on accounts when logging in through single-sign-on provider"),
-            help_text=_(
-                "If disabled, pretix does not allow to log in through a single-sign-on provider if the customer is registered with email and password."
-            ),
-            widget=forms.CheckboxInput(attrs={'data-display-dependency': '#id_settings-customer_accounts'}),
-        )
-    },
     'customer_accounts_require_login_for_order_access': {
         'default': 'False',
         'type': bool,

src/pretix/control/forms/organizer.py

@@ -600,7 +600,6 @@ class OrganizerSettingsForm(SettingsForm):
         'allowed_restricted_plugins',
         'customer_accounts',
         'customer_accounts_native',
-        'customer_accounts_to_oidc',
         'customer_accounts_link_by_email',
         'customer_accounts_require_login_for_order_access',
         'invoice_regenerate_allowed',

src/pretix/presale/views/customer.py

@@ -865,7 +865,7 @@ class SSOLoginReturnView(RedirectBackMixin, View):
                     )
                 except Customer.DoesNotExist:
                     # no race-condition, try to convert to oidc?
-                    if self.request.organizer.settings.customer_accounts_to_oidc:
+                    if self.provider.allow_convert_to_sso:
                         try:
                             customer = self.request.organizer.customers.get(
                                 email=profile['email'],
@@ -873,8 +873,8 @@ class SSOLoginReturnView(RedirectBackMixin, View):
                             customer.set_unusable_password()
                             customer.provider = self.provider
                             customer.external_identifier = str(profile['uid'])
-                            customer.identifier = identifier
-                            customer.is_active = True
+                            #customer.identifier = identifier
+                            #customer.is_active = True
                             customer.is_verified = True
                             if name_parts:
                                 customer.name_parts = name_parts

src/tests/presale/test_customer.py

@@ -441,8 +441,9 @@ def test_org_sso_login_new_customer_email_conflict(env, client, provider):
 @pytest.mark.django_db(transaction=True)
 def test_org_sso_convert_customer_on_login(env, client, provider):
     organizer = env[0]
-    organizer.settings.customer_accounts_to_oidc = True
     with scopes_disabled():
+        provider.allow_convert_to_sso = True
+        provider.save()
         customer = organizer.customers.create(email='new@example.net', is_verified=True, is_active=False)
         customer.set_password('foo')
         customer.save()