Bug 18506 - SSO - Shibboleth Only Mode
Summary: SSO - Shibboleth Only Mode
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Martin Renvoize (ashimema)
QA Contact: Testopia
URL:
Keywords: Manual
Depends on: 12027
Blocks:
  Show dependency tree / graph
 
Reported: 2017-04-28 08:05 UTC by Martin Renvoize (ashimema)
Modified: 2023-02-01 21:12 UTC (History)
11 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
This enhancement adds a system preference to allow libraries to enable shibboleth to work as the only authentication method available for their library and as such practice fully devolved authentication. When combined with the OpacPublic preference, this can be used to enable seamless Single Sign On, where the user simply browses to the OPAC in their web browser and if already logged in on their domain they will automatically be logged in in koha too.
Version(s) released in:
21.05.00,20.11.04
Circulation function:

Attachments
BUG 18506 - Add xShibOnly preference for shibboleth (3.85 KB, patch)
2017-04-28 08:09 UTC, Martin Renvoize (ashimema) 		Details | Diff | Splinter Review
BUG 18506 - Add xShibOnly preference for shibboleth (3.85 KB, patch)
2018-09-18 13:10 UTC, Martin Renvoize (ashimema) 		Details | Diff | Splinter Review
BUG 18506 - Add xShibOnly preference for shibboleth (3.85 KB, patch)
2018-09-27 15:02 UTC, Martin Renvoize (ashimema) 		Details | Diff | Splinter Review
Bug 18506: (followup) Make this play nicely with opacPublic (2.61 KB, patch)
2018-09-27 15:02 UTC, Martin Renvoize (ashimema) 		Details | Diff | Splinter Review
Bug 18506: (followup) Make this play nicely with opacPublic (3.50 KB, patch)
2018-09-27 16:07 UTC, Martin Renvoize (ashimema) 		Details | Diff | Splinter Review
Bug 18506: Add xShibOnly preference for Shibboleth authentication (3.86 KB, patch)
2019-05-07 09:16 UTC, Martin Renvoize (ashimema) 		Details | Diff | Splinter Review
Bug 18506: (followup) Make this play nicely with opacPublic (3.50 KB, patch)
2019-05-07 09:16 UTC, Martin Renvoize (ashimema) 		Details | Diff | Splinter Review
Bug 18506: Add xShibOnly preference for Shibboleth authentication (3.86 KB, patch)
2019-06-26 10:36 UTC, Martin Renvoize (ashimema) 		Details | Diff | Splinter Review
Bug 18506: (follow-up) Make this play nicely with opacPublic (3.50 KB, patch)
2019-06-26 10:36 UTC, Martin Renvoize (ashimema) 		Details | Diff | Splinter Review
Bug 18506: (follow-up) Handle shibOnly in opac-auth.tt (18.69 KB, patch)
2019-06-26 10:36 UTC, Martin Renvoize (ashimema) 		Details | Diff | Splinter Review
Bug 18506: (follow-up) Set redirect type to 303 (972 bytes, patch)
2019-09-09 11:35 UTC, Martin Renvoize (ashimema) 		Details | Diff | Splinter Review
Bug 18506: Add xShibOnly preference for Shibboleth authentication (3.94 KB, patch)
2019-09-10 09:29 UTC, Matthias Meusburger 		Details | Diff | Splinter Review
Bug 18506: (follow-up) Make this play nicely with opacPublic (3.57 KB, patch)
2019-09-10 09:29 UTC, Matthias Meusburger 		Details | Diff | Splinter Review
Bug 18506: (follow-up) Handle shibOnly in opac-auth.tt (18.76 KB, patch)
2019-09-10 09:29 UTC, Matthias Meusburger 		Details | Diff | Splinter Review
Bug 18506: (follow-up) Set redirect type to 303 (1.01 KB, patch)
2019-09-10 09:29 UTC, Matthias Meusburger 		Details | Diff | Splinter Review
Bug 18506: Add xShibOnly preference for Shibboleth authentication (8.20 KB, patch)
2021-02-03 12:36 UTC, Martin Renvoize (ashimema) 		Details | Diff | Splinter Review
Bug 18506: Add xShibOnly preference for Shibboleth authentication (8.27 KB, patch)
2021-02-03 12:40 UTC, Martin Renvoize (ashimema) 		Details | Diff | Splinter Review
Bug 18506: (QA follow-up) opacShibOnly -> OPACShibOnly (6.64 KB, patch)
2021-02-03 12:46 UTC, Martin Renvoize (ashimema) 		Details | Diff | Splinter Review
Bug 18506: Add xShibOnly preference for Shibboleth authentication (8.36 KB, patch)
2021-02-03 15:52 UTC, Nick Clemens (kidclamp) 		Details | Diff | Splinter Review
Bug 18506: (QA follow-up) opacShibOnly -> OPACShibOnly (6.73 KB, patch)
2021-02-03 15:52 UTC, Nick Clemens (kidclamp) 		Details | Diff | Splinter Review
Bug 18506: (QA follow-up) Indentation and more conditionals add (30.97 KB, patch)
2021-02-03 15:52 UTC, Nick Clemens (kidclamp) 		Details | Diff | Splinter Review
Bug 18506: (QA follow-up) Indentation and more conditionals (31.00 KB, patch)
2021-02-03 18:16 UTC, Martin Renvoize (ashimema) 		Details | Diff | Splinter Review
Bug 18506: Add xShibOnly preference for Shibboleth authentication (8.36 KB, patch)
2021-02-09 07:28 UTC, Martin Renvoize (ashimema) 		Details | Diff | Splinter Review
Bug 18506: (QA follow-up) opacShibOnly -> OPACShibOnly (6.73 KB, patch)
2021-02-09 07:28 UTC, Martin Renvoize (ashimema) 		Details | Diff | Splinter Review
Bug 18506: (QA follow-up) Indentation and more conditionals (30.62 KB, patch)
2021-02-09 07:28 UTC, Martin Renvoize (ashimema) 		Details | Diff | Splinter Review
Bug 18506: (QA follow-up) Indentation and more conditionals (30.64 KB, patch)
2021-02-09 08:49 UTC, Jonathan Druart 		Details | Diff | Splinter Review
Show Obsolete (23) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Martin Renvoize (ashimema) 2017-04-28 08:05:01 UTC 
Shibboleth works at it's best when it is the ONLY form of authentication allowed on the system.

That way, if you disable opacPublic you can have a system that automatically redirects the user to the IdP for authentication immediately and skips any other forms of authentication leading to a more seamless SSO solution.
Comment 1 Martin Renvoize (ashimema) 2017-04-28 08:09:12 UTC 
Created attachment 62810 [details] [review]
BUG 18506 - Add xShibOnly preference for shibboleth

This patch adds two system preferences to Koha, opacShibOnly and
staffShibOnly, allowing users to restrict authentication to just
one method, Shibboleth.

A system preference was chosen over a configuration file update to
allow for local override at the virtualhost level. In this way a
hosting provider can setup a 'backdoor opac' for example to allow
fallback to local logins for support operations.
Comment 2 Katrin Fischer 2017-10-15 12:19:37 UTC 
Assigning bug to Martin as he has provided the patch.

Depends on a bug that is in 'Failed QA' - marking as BLOCKED for now.
Comment 3 Katrin Fischer 2017-10-15 12:21:58 UTC 
Comment on attachment 62810 [details] [review]
BUG 18506 - Add xShibOnly preference for shibboleth

Review of attachment 62810 [details] [review]:
-----------------------------------------------------------------

From looking at the patch:

Author in patch file is not correct - PTFS Admin <hosting@ptfs-europe.com>

::: installer/data/mysql/atomicupdate/shibOnly.perl
@@ +1,5 @@
> +$DBversion = 'XXX';  # will be replaced by the RM
> +if( CheckVersion( $DBversion ) ) {
> +    $dbh->do( "INSERT IGNORE INTO systempreferences (variable,value,explanation,options,type) VALUES ('opacShibOnly','0','If ON enables shibboleth only authentication for the opac','','YesNo'),('staffShibOnly','0','If ON enables shibboleth only authentication for the staff client','','YesNo')" );
> +    SetVersion( $DBversion );
> +    print "Upgrade to $DBversion done (Bug XXXXX - shibOnly preferences)\n";

Missing the bug number and maybe a nicer explanation?

::: koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref
@@ +828,5 @@
> +            - pref: opacShibOnly
> +              choices:
> +                  yes: "Don't allow"
> +                  no: Allow
> +            - patrons to login by means other than shibboleth.

Should shibboleth be Shibboleth?
Comment 4 Martin Renvoize (ashimema) 2018-09-18 13:10:58 UTC 
Created attachment 79050 [details] [review]
BUG 18506 - Add xShibOnly preference for shibboleth

This patch adds two system preferences to Koha, opacShibOnly and
staffShibOnly, allowing users to restrict authentication to just
one method, Shibboleth.

A system preference was chosen over a configuration file update to
allow for local override at the virtualhost level. In this way a
hosting provider can setup a 'backdoor opac' for example to allow
fallback to local logins for support operations.
Comment 5 Martin Renvoize (ashimema) 2018-09-18 13:11:32 UTC 
Rebased and made requested corrections.
Comment 6 Julian Maurice 2018-09-27 14:11:02 UTC 
Hi Martin,

it looks like the patch is not complete. It works as expected for OPAC when opacPublic is disabled. But when it's enabled, users are still able to login using their local credentials.
Comment 7 Martin Renvoize (ashimema) 2018-09-27 15:02:22 UTC 
Created attachment 79522 [details] [review]
BUG 18506 - Add xShibOnly preference for shibboleth

This patch adds two system preferences to Koha, opacShibOnly and
staffShibOnly, allowing users to restrict authentication to just
one method, Shibboleth.

A system preference was chosen over a configuration file update to
allow for local override at the virtualhost level. In this way a
hosting provider can setup a 'backdoor opac' for example to allow
fallback to local logins for support operations.
Comment 8 Martin Renvoize (ashimema) 2018-09-27 15:02:25 UTC 
Created attachment 79524 [details] [review]
Bug 18506: (followup) Make this play nicely with opacPublic
Comment 9 Martin Renvoize (ashimema) 2018-09-27 15:03:11 UTC 
Not my most elegant of followups but I think it resolves the issue.

Thanks for testing Julian.
Comment 10 Martin Renvoize (ashimema) 2018-09-27 16:07:22 UTC 
Created attachment 79540 [details] [review]
Bug 18506: (followup) Make this play nicely with opacPublic
Comment 11 Martin Renvoize (ashimema) 2019-05-07 09:16:31 UTC 
Created attachment 89423 [details] [review]
Bug 18506: Add xShibOnly preference for Shibboleth authentication

This patch adds two system preferences to Koha, opacShibOnly and
staffShibOnly, allowing users to restrict authentication to just
one method, Shibboleth.

A system preference was chosen over a configuration file update to
allow for local override at the virtualhost level. In this way a
hosting provider can setup a 'backdoor opac' for example to allow
fallback to local logins for support operations.
Comment 12 Martin Renvoize (ashimema) 2019-05-07 09:16:33 UTC 
Created attachment 89424 [details] [review]
Bug 18506: (followup) Make this play nicely with opacPublic
Comment 13 Martin Renvoize (ashimema) 2019-05-07 09:18:06 UTC 
Freshly rebased.
Comment 14 Nick Clemens (kidclamp) 2019-06-25 16:57:50 UTC 
Needs changes to opac-auth.tt too
Comment 15 Martin Renvoize (ashimema) 2019-06-26 09:44:30 UTC 
(In reply to Nick Clemens from comment #14)
> Needs changes to opac-auth.tt too

In theory you shouldn't be able to navigate to opac-auth.tt.. but it's not a bad idea to include handling there anyway. Follow-up incoming
Comment 16 Martin Renvoize (ashimema) 2019-06-26 10:36:02 UTC 
Created attachment 91011 [details] [review]
Bug 18506: Add xShibOnly preference for Shibboleth authentication

This patch adds two system preferences to Koha, opacShibOnly and
staffShibOnly, allowing users to restrict authentication to just
one method, Shibboleth.

A system preference was chosen over a configuration file update to
allow for local override at the virtualhost level. In this way a
hosting provider can setup a 'backdoor opac' for example to allow
fallback to local logins for support operations.
Comment 17 Martin Renvoize (ashimema) 2019-06-26 10:36:05 UTC 
Created attachment 91012 [details] [review]
Bug 18506: (follow-up) Make this play nicely with opacPublic
Comment 18 Martin Renvoize (ashimema) 2019-06-26 10:36:09 UTC 
Created attachment 91013 [details] [review]
Bug 18506: (follow-up) Handle shibOnly in opac-auth.tt

This patch adds the shibOnly conditional to the opac-auth.tt template
such that if shibOnly is enabled then only the shibboleth login link
,and any shibboleth login errors if there are any, will display.

It does not however preclude SCO and SCI login, those are still
available if when SCO_login or SCI_login parameters are passed.
Comment 19 Martin Renvoize (ashimema) 2019-06-26 10:38:41 UTC 
Fresh rebase, tidy up of QA script failures and follow-up added to address Nicks concerns.

That last followup was more complex than anticipated.. I think that template could do with a bit of a tidy up and my patch includes some whitespace changes I did along the way to try and keep track of what I was doing.. I could remove those if requested.
Comment 20 Matthias Meusburger 2019-07-26 09:24:38 UTC 
Hi, 

I've done some testing, and it works consistently with the various combinations of opacShibOnly, OpacPublic and staffShibOnly.

However, when opacShibOnly is enabled, the authentication process always redirect to opac-user.pl, instead of the page the user was currently on (like a search result, for example).

The user should be redirected to the page he was on, like when opacShibOnly is disabled.

Also I'm a little concerned that users might lock themselves out of the admin interface when enabling staffShibOnly, but that's nothing an SQL query to modify the syspref's value can't fix.
Comment 21 Martin Renvoize (ashimema) 2019-09-09 11:05:54 UTC 
(In reply to Matthias Meusburger from comment #20)
> Hi, 
> 
> I've done some testing, and it works consistently with the various
> combinations of opacShibOnly, OpacPublic and staffShibOnly.
> 
> However, when opacShibOnly is enabled, the authentication process always
> redirect to opac-user.pl, instead of the page the user was currently on
> (like a search result, for example).
> 
> The user should be redirected to the page he was on, like when opacShibOnly
> is disabled.

Noted, I'll take a look at doing this in a follow-up now.

> 
> Also I'm a little concerned that users might lock themselves out of the
> admin interface when enabling staffShibOnly, but that's nothing an SQL query
> to modify the syspref's value can't fix.

So I agree with this, but as it's the feature our customers have requested I think it's a valid use case.

What we do at PTFS-E is use the syspref override in the vhosts and setup a second alias for local support so we can still login.
Comment 22 Martin Renvoize (ashimema) 2019-09-09 11:35:09 UTC 
Created attachment 92665 [details] [review]
Bug 18506: (follow-up) Set redirect type to 303

This should ensure query parameters are passed through the redirection.
Comment 23 Matthias Meusburger 2019-09-10 09:26:14 UTC 
The parameters are now kept after login, I'm signing this off.
Comment 24 Matthias Meusburger 2019-09-10 09:29:30 UTC 
Created attachment 92680 [details] [review]
Bug 18506: Add xShibOnly preference for Shibboleth authentication

This patch adds two system preferences to Koha, opacShibOnly and
staffShibOnly, allowing users to restrict authentication to just
one method, Shibboleth.

A system preference was chosen over a configuration file update to
allow for local override at the virtualhost level. In this way a
hosting provider can setup a 'backdoor opac' for example to allow
fallback to local logins for support operations.

Signed-off-by: Matthias Meusburger <matthias.meusburger@biblibre.com>
Comment 25 Matthias Meusburger 2019-09-10 09:29:37 UTC 
Created attachment 92681 [details] [review]
Bug 18506: (follow-up) Make this play nicely with opacPublic

Signed-off-by: Matthias Meusburger <matthias.meusburger@biblibre.com>
Comment 26 Matthias Meusburger 2019-09-10 09:29:43 UTC 
Created attachment 92682 [details] [review]
Bug 18506: (follow-up) Handle shibOnly in opac-auth.tt

This patch adds the shibOnly conditional to the opac-auth.tt template
such that if shibOnly is enabled then only the shibboleth login link
,and any shibboleth login errors if there are any, will display.

It does not however preclude SCO and SCI login, those are still
available if when SCO_login or SCI_login parameters are passed.

Signed-off-by: Matthias Meusburger <matthias.meusburger@biblibre.com>
Comment 27 Matthias Meusburger 2019-09-10 09:29:47 UTC 
Created attachment 92683 [details] [review]
Bug 18506: (follow-up) Set redirect type to 303

This should ensure query parameters are passed through the redirection.

Signed-off-by: Matthias Meusburger <matthias.meusburger@biblibre.com>
Comment 28 Katrin Fischer 2019-10-10 06:12:58 UTC 
As we have a strong sign-off here and also some QA opinions, we should try and move this forward. Can we get a rebase please?

Also a request: Could we make it OpacShibOnly or better OPACShibOnly? That seems to be more the standard looking at the other existing prefs.
Comment 29 David Cook 2020-05-19 04:57:33 UTC 
Pretty interested by this.

We have our own separate Shibboleth integration, and I recently did a SAML-only SSO auth for it. It would be interesting to compare them...
Comment 30 Martin Renvoize (ashimema) 2021-02-03 12:36:56 UTC 
Created attachment 116250 [details] [review]
Bug 18506: Add xShibOnly preference for Shibboleth authentication

This patch adds two system preferences to Koha, opacShibOnly and
staffShibOnly, allowing users to restrict authentication to just
one method, Shibboleth.

We do however, allow for local fallback for the SCO/SCI logins.

A system preference was chosen over a configuration file update to
allow for local override at the virtualhost level. In this way a
hosting provider can setup a 'backdoor opac' for example to allow
fallback to local logins for support operations.
Comment 31 Martin Renvoize (ashimema) 2021-02-03 12:40:19 UTC 
Created attachment 116251 [details] [review]
Bug 18506: Add xShibOnly preference for Shibboleth authentication

This patch adds two system preferences to Koha, opacShibOnly and
staffShibOnly, allowing users to restrict authentication to just
one method, Shibboleth.

We do however, allow for local fallback for the SCO/SCI logins.

A system preference was chosen over a configuration file update to
allow for local override at the virtualhost level. In this way a
hosting provider can setup a 'backdoor opac' for example to allow
fallback to local logins for support operations.

Signed-off-by: Matthias Meusburger <matthias.meusburger@biblibre.com>
Comment 32 Martin Renvoize (ashimema) 2021-02-03 12:46:20 UTC 
Created attachment 116253 [details] [review]
Bug 18506: (QA follow-up) opacShibOnly -> OPACShibOnly

As requested
Comment 33 Martin Renvoize (ashimema) 2021-02-03 12:47:12 UTC 
I've been porting this work from version to version on customer sites for a matter of years now.. would be wonderful to get it passed the finish line.
Comment 34 Jonathan Druart 2021-02-03 13:03:32 UTC 
David, can you put your QA stamp on this one?
Comment 35 Nick Clemens (kidclamp) 2021-02-03 15:52:37 UTC 
Created attachment 116280 [details] [review]
Bug 18506: Add xShibOnly preference for Shibboleth authentication

This patch adds two system preferences to Koha, opacShibOnly and
staffShibOnly, allowing users to restrict authentication to just
one method, Shibboleth.

We do however, allow for local fallback for the SCO/SCI logins.

A system preference was chosen over a configuration file update to
allow for local override at the virtualhost level. In this way a
hosting provider can setup a 'backdoor opac' for example to allow
fallback to local logins for support operations.

Signed-off-by: Matthias Meusburger <matthias.meusburger@biblibre.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 36 Nick Clemens (kidclamp) 2021-02-03 15:52:41 UTC 
Created attachment 116281 [details] [review]
Bug 18506: (QA follow-up) opacShibOnly -> OPACShibOnly

As requested

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 37 Nick Clemens (kidclamp) 2021-02-03 15:52:44 UTC 
Created attachment 116282 [details] [review]
Bug 18506: (QA follow-up) Indentation and more conditionals add

Indentation fixes for readability

Cleaned up a few places where the ability to login otherwise was leakign through

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 38 Martin Renvoize (ashimema) 2021-02-03 18:16:59 UTC 
Created attachment 116290 [details] [review]
Bug 18506: (QA follow-up) Indentation and more conditionals

Indentation fixes for readability

Cleaned up a few places where the ability to login otherwise was leakign through

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 39 Martin Renvoize (ashimema) 2021-02-03 18:18:00 UTC 
Thanks for the followup.. seems more had changed since the last rebase than I thought :(.

Looks great and I've double-checked with some extra testing here :)
Comment 40 Jonathan Druart 2021-02-08 14:23:50 UTC 
Please rebase on top of bug 27476.
Comment 41 Martin Renvoize (ashimema) 2021-02-09 07:28:49 UTC 
Created attachment 116536 [details] [review]
Bug 18506: Add xShibOnly preference for Shibboleth authentication

This patch adds two system preferences to Koha, opacShibOnly and
staffShibOnly, allowing users to restrict authentication to just
one method, Shibboleth.

We do however, allow for local fallback for the SCO/SCI logins.

A system preference was chosen over a configuration file update to
allow for local override at the virtualhost level. In this way a
hosting provider can setup a 'backdoor opac' for example to allow
fallback to local logins for support operations.

Signed-off-by: Matthias Meusburger <matthias.meusburger@biblibre.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 42 Martin Renvoize (ashimema) 2021-02-09 07:28:53 UTC 
Created attachment 116537 [details] [review]
Bug 18506: (QA follow-up) opacShibOnly -> OPACShibOnly

As requested

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 43 Martin Renvoize (ashimema) 2021-02-09 07:28:57 UTC 
Created attachment 116538 [details] [review]
Bug 18506: (QA follow-up) Indentation and more conditionals

Indentation fixes for readability

Cleaned up a few places where the ability to login otherwise was leakign through

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 44 Martin Renvoize (ashimema) 2021-02-09 07:29:14 UTC 
Rebased
Comment 45 Jonathan Druart 2021-02-09 08:49:18 UTC 
Created attachment 116540 [details] [review]
Bug 18506: (QA follow-up) Indentation and more conditionals

Indentation fixes for readability

Cleaned up a few places where the ability to login otherwise was leakign through

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

JD amended patch: Remove trailing spaces
Comment 46 Jonathan Druart 2021-02-09 08:50:07 UTC 
Pushed to master for 21.05, thanks to everybody involved!
Comment 47 Fridolin Somers 2021-02-12 14:49:20 UTC 
Do you think we can backport to 20.11.x ?
Comment 48 Martin Renvoize (ashimema) 2021-02-13 08:40:38 UTC 
It applies reasonably easily, I've backported it to our local 20.11 branch.. but it is an enhancement strictly, so your call as rmaint.. we trust you :)
Comment 49 Fridolin Somers 2021-02-25 09:15:00 UTC 
Pushed to 20.11.x for 20.11.04
Comment 50 Andrew Fuerste-Henry 2021-03-04 17:31:29 UTC 
Not backporting to 20.05. Please ask if needed.
Comment 51 David Cook 2021-07-15 23:52:44 UTC 
One of these days I'll rewrite checkauth() / replace it. One of these days...

I'm glad to see this though. We use Shibboleth in a very different way locally, but I implemented a Shibboleth only option a year or two as I found a lot of people were asking for it.
Comment 52 Andrew Fuerste-Henry 2023-02-01 21:12:14 UTC 
*** Bug 22842 has been marked as a duplicate of this bug. ***