Bug 28093

Summary:	Additional configuration option(s) for Shibboleth-only mode
Product:	Koha	Reporter:	Andy Boze <Boze.1>
Component:	Authentication	Assignee:	Martin Renvoize (ashimema) <martin.renvoize>
Status:	NEW ---	QA Contact:	Testopia <testopia>
Severity:	enhancement
Priority:	P5 - low	CC:	dcook, dpavlin, fridolin.somers, martin.renvoize, nick
Version:	Main
Hardware:	All
OS:	All
See Also:	https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18506 https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33614
Change sponsored?:	Seeking sponsor	Patch complexity:	---
Documentation contact:		Documentation submission:
Text to go in the release notes:		Version(s) released in:
Circulation function:

Description Andy Boze 2021-04-06 04:28:08 UTC

Regarding bug 18506 , in the staff client with Shibboleth Only Mode enabled, when one logs out, the user is immediately logged back in to the staff client. I understand that this is the intended behavior and could be solved by using Single LogOut (SLO). SLO, however, would log the user out of all current Shibboleth sessions, which would not be desirable (for us). In addition, if the user is already logged in to Shibboleth, when visiting the staff client for the first time, the user is automatically logged in without seeing a login page.

We would find it preferable if there were an option for Shibboleth-only mode (in the staff client) to have a landing page that would prompt the user to log in (whether or not the user had already authenticated). If the user was already authenticated, the user would simply be passed on to the staff client without needing to provide credentials. On logout, the user would return to the landing page but not be logged out of Shibboleth.

Another alternative could be to have a new option that would disable local logins (except for self checkout) if some other authentication method (CAS, Shibboleth) has been activated. Basically this would look the same as the current login page, but with no option for local login. On logout, the user would be returned to the login page.

Comment 1 David Cook 2022-06-29 03:43:16 UTC

Sounds reasonable to me.

Comment 2 Martin Renvoize (ashimema) 2023-01-26 17:26:24 UTC

Nice idea.. I think it makes a lot of sense to allow disabling of the local login type as an option.

Comment 3 Martin Renvoize (ashimema) 2023-02-01 21:21:39 UTC

*** Bug 22842 has been marked as a duplicate of this bug. ***

Comment 4 Katrin Fischer 2023-05-01 13:57:45 UTC

I was looking into making the bug description a bit more specific, but now I am not sure if this shouldn't be separate bugs:

* Add a landing page for Shibboleth/external auth that the user is redirected to
  * when being automatically logged in
  * when logging out

I wonder if the first could be annoying or if we should still provide  way to get to the URL that was originally requested somehow.

* Deactivate local login if external auth is activated.

It looks like we already have this for Shibboleth with OPACShibOnly/staffShibOnly? So would this be for extending this beyond Shibboleth?