Bug 28093 - Additional configuration option(s) for Shibboleth-only mode
Summary: Additional configuration option(s) for Shibboleth-only mode
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Martin Renvoize
QA Contact: Testopia
URL:
Keywords:
: 22842 (view as bug list)
Depends on:
Blocks:
 
Reported: 2021-04-06 04:28 UTC by Andy Boze
Modified: 2023-05-01 13:57 UTC (History)
5 users (show)

See Also:
Change sponsored?: Seeking sponsor
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Andy Boze 2021-04-06 04:28:08 UTC
Regarding bug 18506 , in the staff client with Shibboleth Only Mode enabled, when one logs out, the user is immediately logged back in to the staff client. I understand that this is the intended behavior and could be solved by using Single LogOut (SLO). SLO, however, would log the user out of all current Shibboleth sessions, which would not be desirable (for us). In addition, if the user is already logged in to Shibboleth, when visiting the staff client for the first time, the user is automatically logged in without seeing a login page.

We would find it preferable if there were an option for Shibboleth-only mode (in the staff client) to have a landing page that would prompt the user to log in (whether or not the user had already authenticated). If the user was already authenticated, the user would simply be passed on to the staff client without needing to provide credentials. On logout, the user would return to the landing page but not be logged out of Shibboleth.

Another alternative could be to have a new option that would disable local logins (except for self checkout) if some other authentication method (CAS, Shibboleth) has been activated. Basically this would look the same as the current login page, but with no option for local login. On logout, the user would be returned to the login page.
Comment 1 David Cook 2022-06-29 03:43:16 UTC
Sounds reasonable to me.
Comment 2 Martin Renvoize 2023-01-26 17:26:24 UTC
Nice idea.. I think it makes a lot of sense to allow disabling of the local login type as an option.
Comment 3 Martin Renvoize 2023-02-01 21:21:39 UTC
*** Bug 22842 has been marked as a duplicate of this bug. ***
Comment 4 Katrin Fischer 2023-05-01 13:57:45 UTC
I was looking into making the bug description a bit more specific, but now I am not sure if this shouldn't be separate bugs:

* Add a landing page for Shibboleth/external auth that the user is redirected to
  * when being automatically logged in
  * when logging out

I wonder if the first could be annoying or if we should still provide  way to get to the URL that was originally requested somehow.

* Deactivate local login if external auth is activated.

It looks like we already have this for Shibboleth with OPACShibOnly/staffShibOnly? So would this be for extending this beyond Shibboleth?