Bug 38815

Summary: Optionally block local login of accounts set for SSO
Product: Koha Reporter: Andrew Fuerste-Henry <andrew>
Component: AuthenticationAssignee: Bugs List <koha-bugs>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: dpavlin
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Description Andrew Fuerste-Henry 2025-01-02 18:30:53 UTC
Bug 18506 added the ability to completely prevent local login (login using the koha username and password) when using SSO, but many libraries using SSO find it necessary to allow local login for some users or situations -- community borrowers at an academic library, support vendors who lack SSO credentials, etc.

If both SSO and local login must be allowed, libraries want to ensure that any given account can only log in one way -- if your account can authenticate via SSO, you should not be able to authenticate via local login. Libraries enforce this by setting NULL passwords in Koha on accounts using SSO, but at the very least any superlibrarian is able to change that password.

It would be helpful to be able to flag an account as "SSO only" and thereby force Koha to null the password and keep it null, hiding the Change Password button and the password field from patron edit.