Add cr remarks

ee/lib/gitlab/auth/group_saml/user.rb

@@ -51,8 +51,9 @@ module Gitlab
         override :find_by_email
         def find_by_email
           user = super
+          return unless user&.authorized_by_provisioning_group?(saml_provider.group)
 
-          return user if user&.authorized_by_provisioning_group?(saml_provider.group)
+          user
         end
 
         override :build_new_user

ee/spec/features/groups/members/leave_group_spec.rb

@@ -5,9 +5,10 @@ require 'spec_helper'
 RSpec.describe 'Groups > Members > Leave group' do
   include Spec::Support::Helpers::Features::MembersHelpers
 
+  let_it_be(:other_user) { create(:user) }
+  let_it_be(:group) { create(:group) }
+
   let(:user) { create(:user) }
-  let(:other_user) { create(:user) }
-  let(:group) { create(:group) }
 
   before do
     user.update!(provisioned_by_group: group)

ee/spec/models/ee/user_spec.rb

@@ -814,6 +814,90 @@ RSpec.describe User do
     end
   end
 
+  describe '#user_authorized_by_provisioning_group?' do
+    context 'when user is provisioned by group' do
+      before do
+        user.user_detail.provisioned_by_group = build(:group)
+      end
+
+      it 'is true' do
+        expect(user.user_authorized_by_provisioning_group?).to eq true
+      end
+
+      context 'with feature flag switched off' do
+        before do
+          stub_feature_flags(block_password_auth_for_saml_users: false)
+        end
+
+        it 'is false' do
+          expect(user.user_authorized_by_provisioning_group?).to eq false
+        end
+      end
+    end
+
+    context 'when user is not provisioned by group' do
+      it 'is false' do
+        expect(user.user_authorized_by_provisioning_group?).to eq false
+      end
+
+      context 'with feature flag switched off' do
+        before do
+          stub_feature_flags(block_password_auth_for_saml_users: false)
+        end
+
+        it 'is false' do
+          expect(user.user_authorized_by_provisioning_group?).to eq false
+        end
+      end
+    end
+  end
+
+  describe '#authorized_by_provisioning_group?' do
+    let_it_be(:group) { create(:group) }
+
+    context 'when user is provisioned by group' do
+      before do
+        user.user_detail.provisioned_by_group = group
+      end
+
+      it 'is true' do
+        expect(user.authorized_by_provisioning_group?(group)).to eq true
+      end
+
+      context 'when other group is provided' do
+        it 'is false' do
+          expect(user.authorized_by_provisioning_group?(create(:group))).to eq false
+        end
+      end
+
+      context 'with feature flag switched off' do
+        before do
+          stub_feature_flags(block_password_auth_for_saml_users: false)
+        end
+
+        it 'is false' do
+          expect(user.authorized_by_provisioning_group?(group)).to eq false
+        end
+      end
+    end
+
+    context 'when user is not provisioned by group' do
+      it 'is false' do
+        expect(user.authorized_by_provisioning_group?(group)).to eq false
+      end
+
+      context 'with feature flag switched off' do
+        before do
+          stub_feature_flags(block_password_auth_for_saml_users: false)
+        end
+
+        it 'is false' do
+          expect(user.authorized_by_provisioning_group?(group)).to eq false
+        end
+      end
+    end
+  end
+
   describe '#using_license_seat?' do
     let(:user) { create(:user) }