Prevent deactivated user to connect using sso

packages/strapi-admin/ee/controllers/authentication/middlewares.js

@@ -26,15 +26,31 @@ const authenticate = async (ctx, next) => {
       return ctx.redirect(redirectUrls.error);
     }
 
-    const { email, firstname, lastname, username } = profile;
+    const user = await strapi.admin.services.user.findOne({ email: profile.email });
-    const user = await strapi.admin.services.user.findOne({ email });
+    const scenario = user ? existingUserScenario : nonExistingUserScenario;
 
-    // If a profile exists with this email, login with this user
+    return scenario(ctx, next)(user || profile, provider);
-    if (user) {
+  })(ctx, next);
-      ctx.state.user = user;
+};
-      return next();
+
+const existingUserScenario = (ctx, next) => async (user, provider) => {
+  const redirectUrls = utils.getPrefixedRedirectUrls();
+
+  if (!user.isActive) {
+    strapi.eventHub.emit('admin.auth.error', {
+      error: new Error(`Deactivated user tried to login (${user.id})`),
+      provider,
+    });
+    return ctx.redirect(redirectUrls.error);
   }
 
+  ctx.state.user = user;
+  return next();
+};
+
+const nonExistingUserScenario = (ctx, next) => async (profile, provider) => {
+  const { email, firstname, lastname, username } = profile;
+  const redirectUrls = utils.getPrefixedRedirectUrls();
   const adminStore = await utils.getAdminStore();
   const { providers } = await adminStore.get({ key: 'auth' });
 
@@ -71,7 +87,6 @@ const authenticate = async (ctx, next) => {
   });
 
   return next();
-  })(ctx, next);
 };
 
 const redirectWithAuth = ctx => {