Bug 28093

Summary: Additional configuration option(s) for Shibboleth-only mode
Product: Koha Reporter: Andy Boze <Boze.1>
Component: AuthenticationAssignee: Martin Renvoize <martin.renvoize>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: dcook, dpavlin, fridolin.somers, martin.renvoize, nick
Version: Main   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18506
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33614
Change sponsored?: Seeking sponsor Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:

Description Andy Boze 2021-04-06 04:28:08 UTC
Regarding bug 18506 , in the staff client with Shibboleth Only Mode enabled, when one logs out, the user is immediately logged back in to the staff client. I understand that this is the intended behavior and could be solved by using Single LogOut (SLO). SLO, however, would log the user out of all current Shibboleth sessions, which would not be desirable (for us). In addition, if the user is already logged in to Shibboleth, when visiting the staff client for the first time, the user is automatically logged in without seeing a login page.

We would find it preferable if there were an option for Shibboleth-only mode (in the staff client) to have a landing page that would prompt the user to log in (whether or not the user had already authenticated). If the user was already authenticated, the user would simply be passed on to the staff client without needing to provide credentials. On logout, the user would return to the landing page but not be logged out of Shibboleth.

Another alternative could be to have a new option that would disable local logins (except for self checkout) if some other authentication method (CAS, Shibboleth) has been activated. Basically this would look the same as the current login page, but with no option for local login. On logout, the user would be returned to the login page.
Comment 1 David Cook 2022-06-29 03:43:16 UTC
Sounds reasonable to me.
Comment 2 Martin Renvoize 2023-01-26 17:26:24 UTC
Nice idea.. I think it makes a lot of sense to allow disabling of the local login type as an option.
Comment 3 Martin Renvoize 2023-02-01 21:21:39 UTC
*** Bug 22842 has been marked as a duplicate of this bug. ***
Comment 4 Katrin Fischer 2023-05-01 13:57:45 UTC
I was looking into making the bug description a bit more specific, but now I am not sure if this shouldn't be separate bugs:

* Add a landing page for Shibboleth/external auth that the user is redirected to
  * when being automatically logged in
  * when logging out

I wonder if the first could be annoying or if we should still provide  way to get to the URL that was originally requested somehow.

* Deactivate local login if external auth is activated.

It looks like we already have this for Shibboleth with OPACShibOnly/staffShibOnly? So would this be for extending this beyond Shibboleth?