Bug 37715

Summary: It should be possible to enable/disable each authentication method on the OPAC and staff client
Product: Koha Reporter: Nick Clemens (kidclamp) <nick>
Component: System AdministrationAssignee: Bugs List <koha-bugs>
Status: In Discussion --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: dcook, gmcharlt, katrin.fischer, lucas, martin.renvoize, oliver.behnke, tomascohen
Version: Main   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40596
GIT URL: Change sponsored?: ---
Patch complexity: --- Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
Circulation function:
Attachments: Added OpacEnableLocalLogin/StaffEnableLocalLogin to disable local logins

Description Nick Clemens (kidclamp) 2024-08-23 12:53:43 UTC
When setting up identity provides (OAuth/OpenID) you can enable or disable the provider for the OPAC/Staff client

We have the preferences OPACShibOnly and staffShibOnly which will limit everything to Shib

It would be nice to instead have a switch for each:
OpacEnableLocalLogin
OpacEnableCASLogin
OpacEnableShibLogin
OpacEnableLDAPLogin

and staff equivalents

additionally - when using identity providers they always add the line:
<p>If you do not have an external account, but do have a local account, you can still log in: </p>
This needs a class at minimum, but should likely be removed and allow the library to specify the text in loginInstructions html customization
Comment 1 David Cook 2024-09-01 23:37:18 UTC
100% agreed with all of this
Comment 2 Oliver Behnke 2025-08-12 13:13:42 UTC
Just to vote this up a notch! I'm particularly interested in OpacEnableLocalLogin since leaving local login enabled after having switched to OIDC-based SSO is just confusing our users.

Thanks
Comment 3 Oliver Behnke 2025-08-12 14:35:06 UTC
Looking into a patch for OpacEnableLocalLogin...
Comment 4 Oliver Behnke 2025-08-12 16:07:46 UTC
Created attachment 185341 [details] [review]
Added OpacEnableLocalLogin/StaffEnableLocalLogin to disable local logins

Ok, as promised, here's a first patch. I omitted whitespace changes (indentations) to facilitate the patch discussion. Let me know if you want to go forward with this.

Note: what's missing is the corresponding DB rev upgrade.

Cheers
Comment 5 Oliver Behnke 2025-08-13 07:45:51 UTC
(In reply to Nick Clemens (kidclamp) from comment #0)
> It would be nice to instead have a switch for each:
> [...]
> OpacEnableShibLogin
> OpacEnableLDAPLogin

These two are effectively managed in koha-conf.xml [1], presumably since they need further config entries that sysprefs are probably not tailored for. Do you suggest to move those to the sysprefs anyway?

Cheers

[1] https://git.koha-community.org/Koha-community/Koha/src/commit/3ea3c2a27a9e7fad62a30486826f0a1ce3740ace/etc/koha-conf.xml#L105
Comment 6 Oliver Behnke 2025-08-13 07:54:34 UTC
(In reply to Nick Clemens (kidclamp) from comment #0)
> It would be nice to instead have a switch for each:
> [...]
> OpacEnableCASLogin

How would that differ from the existing "casAuthentication"?

Thanks
Comment 7 Oliver Behnke 2025-08-13 15:28:23 UTC
Thanks @tcohen for referencing bug 40596! That means CAS and Shibboleth are already in the process of being refactored - and rightfully so.

May I ask the question if we could thus constrain this bug to controlling local login only, at least if LDAP is out of the question? This way we could expedite my patch which would be highly appreciated by our users ;)

Cheers