"Maximum workspaces" error when logging in with google (gmail.com)

[dennorske]

Hello!

I am running 0.76.1 with docker (compose), and I got most things set up with a breeze. I got SMTP working, and I have enabled my workspace to be logged in with Google login, configured as described in the documentation.

I created a workspace initially by logging in with my google account, linked to my Google Workspace environment (lets call it example.com for ease).

Now when I try to invite a user that has a gmail.com address to the existing workspace:
The user goes to the login page, and tries to log in with google (same email address), and it results in outline saying

"error":"The maximum number of workspaces has been reached"

I have also attempted to allow gmail.com to sign up via google in the allowed domains section for the workspace in Outline.

Is this a bug? If not, can I assist in updating documentation?
It is a bit hard to understand what the error means at first - if it was a google workspace, or an outline workspace. I figured it was Outline in the end by looking at the application logs, but I was not expecting outline to say that when an invited user tries to log in.

It seems to me that new "domains" end up making new workspaces on outline. How can users I invite, log in with google, without getting that error?

I really appreciate your input. And I am very sorry if I had misunderstood something with this.

[tommoor]

I would expect this scenario to work:

• Invite user with gmail address to workspace
• User can sign-in with either email or Google SSO

So it sounds like it's not for some reason, which would be a bug – however this would affect a lot of folks, so it's still most likely some sort of misconfiguration. Some questions / things to check:

• Are they able to sign-in with the email magic-link option?
• Is the capitalization the same?
• Are there any added or missing "." in the gmail address? (In gmail you can add a period anywhere and it will work the same)

[dennorske]

Hi tommoor;

The suggested scenario is what I have attempted. I invited a user via the workspace preferences, and the user has attempted to log in with Google SSO initially. Yes, signing in with e-mail works and has no issues.

My user's initial sign-up happens with my (lets say) domain.com domain, and a workspace is created named domain, fetching information from my domain (as it seems). I then invite a @gmail.com user, and he gets the error.

I have gone to the extent of setting up a new environment, but on an entirely different node to test this.

Capitalization is the same as the user's username in google, and the one that has been provisioned to for example notion.so's member list on an instance we have there.
There are no extra characters added to the email, no extra spaces or dots no.

Pssst: I would not expect a whole lot of private individuals (except for enterprise/businesses) to have a self-managed Google Workspace subscriptions, but I might be wrong on that judgement, maybe hence I am the first one to notice and report it?

I also took a dive into the provisioner and I can see this:
https://github.com/outline/outline/blob/main/server/commands/teamProvisioner.ts#L93

If I understand my case correctly, I am seeing the error because:

• The application is self-hosted.
• A team exists.
• The domain provided for the new team doesn't match the domain of the existing team.

There might be more to it I don't see, but a very interesting issue :)

[tommoor]

But if the user has an account (through invite or full user) this should take precedence over everything else and allow login.

[dennorske]

I tried with a different (personal) email and I am still seeing the same behaviour.

1. I go to members > invite new user > write in my gmail account
2. I log out from my main domain.com account
3. I try to log in with my gmail.com account
4. Getting "Maximum reached" error.

It only happens with the OAuth provider - not if I use magic link to sign in.

[tommoor]

It does sound like a bug then