New user gets it's own space even after settings SOCIAL_DEFAULT_ACCESS to 1

[AnderssonPeter]

So I just started try to add additional users to my tandoor instance.
I added social login using pocket-id.
I had it running with

- DEBUG=0
- SECRET_KEY_FILE=/run/secrets/secret-key
- DB_ENGINE=django.db.backends.postgresql
- POSTGRES_HOST=postgres
- POSTGRES_DB=tandoor
- POSTGRES_USER=tandoor
- POSTGRES_PASSWORD_FILE=/run/secrets/database-password
- ALLOWED_HOSTS=tandoor.${DOMAIN},localhost
- GUNICORN_WORKERS=1
- GUNICORN_THREADS=3
- SOCIAL_PROVIDERS=allauth.socialaccount.providers.openid_connect
- SOCIALACCOUNT_PROVIDERS_FILE=/run/secrets/socialaccount-providers
- SOCIALACCOUNT_LOGIN_ON_GET=1
- SOCIALACCOUNT_ONLY=1

The user joined and got their own space, so I removed the user and their space and added - SOCIAL_DEFAULT_ACCESS=1 and asked the user to log in again, but sadly they got their own space again.

So what am I missing? do I need to clear cookies on the users device or is there some other issue?
I'm running 2.6.11.

[AnderssonPeter]

I'm a bit perplexed what When enabled, new social login users will automatically join the first existing space with the group configured in SOCIAL_DEFAULT_GROUP. means, do I need to add the guest group to my existing space? and how would I do that?
https://docs.tandoor.dev/system/configuration/#authentication

Edit: when I go to the admin panel for tandoor and look at the space, the Household setup completed is not checked, not sure what it does or what I need to do to make it completed.

[VectorPeak]

SOCIAL_DEFAULT_ACCESS=1 does not use cookies, so clearing the user’s browser will not change this. It is evaluated server-side for a newly created social user, and it should add that user to the first existing Space with the permission group from SOCIAL_DEFAULT_GROUP (guest by default). The wording is a bit confusing: you do not add a “guest group” to the space manually; guest, user, and admin are Django groups, and Tandoor attaches one of them to the new UserSpace relation. (docs.tandoor.dev)

The two things I would check are:

docker compose exec <tandoor-service-name> env | grep SOCIAL_DEFAULT

and then fully recreate/restart the Tandoor app container after adding the env var:

docker compose up -d --force-recreate <tandoor-service-name>

If the variable is loaded correctly, also make sure there is already an existing space before the new user signs in. The code uses the first existing space (Space.objects.first()), and if no space or matching group exists it only logs a warning instead of assigning access. (raw.githubusercontent.com)

One more gotcha: this will not retroactively move users who already have a UserSpace. If the user account still exists, or they already created their own space before the setting was active, delete/adjust that user’s space membership in admin or test with a completely new social account. If your goal is also to stop normal users from creating their own spaces, that is separate from SOCIAL_DEFAULT_ACCESS; look at MAX_OWNED_SPACES_PREF_DEFAULT=0.

---

If my answer solved your problem, you can click answered the question. I'm really here to help, and along the way I'm also collecting Galaxy Brain badges haha 😆