Bug 37715 - It should be possible to enable/disable each authentication method on the OPAC and staff client
Summary: It should be possible to enable/disable each authentication method on the OPA...
Status: In Discussion
Alias: None
Product: Koha
Classification: Unclassified
Component: System Administration (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-08-23 12:53 UTC by Nick Clemens (kidclamp)
Modified: 2025-08-14 07:08 UTC (History)
7 users (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Added OpacEnableLocalLogin/StaffEnableLocalLogin to disable local logins (10.19 KB, patch)
2025-08-12 16:07 UTC, Oliver Behnke
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Nick Clemens (kidclamp) 2024-08-23 12:53:43 UTC
When setting up identity provides (OAuth/OpenID) you can enable or disable the provider for the OPAC/Staff client

We have the preferences OPACShibOnly and staffShibOnly which will limit everything to Shib

It would be nice to instead have a switch for each:
OpacEnableLocalLogin
OpacEnableCASLogin
OpacEnableShibLogin
OpacEnableLDAPLogin

and staff equivalents

additionally - when using identity providers they always add the line:
<p>If you do not have an external account, but do have a local account, you can still log in: </p>
This needs a class at minimum, but should likely be removed and allow the library to specify the text in loginInstructions html customization
Comment 1 David Cook 2024-09-01 23:37:18 UTC
100% agreed with all of this
Comment 2 Oliver Behnke 2025-08-12 13:13:42 UTC
Just to vote this up a notch! I'm particularly interested in OpacEnableLocalLogin since leaving local login enabled after having switched to OIDC-based SSO is just confusing our users.

Thanks
Comment 3 Oliver Behnke 2025-08-12 14:35:06 UTC
Looking into a patch for OpacEnableLocalLogin...
Comment 4 Oliver Behnke 2025-08-12 16:07:46 UTC
Created attachment 185341 [details] [review]
Added OpacEnableLocalLogin/StaffEnableLocalLogin to disable local logins

Ok, as promised, here's a first patch. I omitted whitespace changes (indentations) to facilitate the patch discussion. Let me know if you want to go forward with this.

Note: what's missing is the corresponding DB rev upgrade.

Cheers
Comment 5 Oliver Behnke 2025-08-13 07:45:51 UTC
(In reply to Nick Clemens (kidclamp) from comment #0)
> It would be nice to instead have a switch for each:
> [...]
> OpacEnableShibLogin
> OpacEnableLDAPLogin

These two are effectively managed in koha-conf.xml [1], presumably since they need further config entries that sysprefs are probably not tailored for. Do you suggest to move those to the sysprefs anyway?

Cheers

[1] https://git.koha-community.org/Koha-community/Koha/src/commit/3ea3c2a27a9e7fad62a30486826f0a1ce3740ace/etc/koha-conf.xml#L105
Comment 6 Oliver Behnke 2025-08-13 07:54:34 UTC
(In reply to Nick Clemens (kidclamp) from comment #0)
> It would be nice to instead have a switch for each:
> [...]
> OpacEnableCASLogin

How would that differ from the existing "casAuthentication"?

Thanks
Comment 7 Oliver Behnke 2025-08-13 15:28:23 UTC
Thanks @tcohen for referencing bug 40596! That means CAS and Shibboleth are already in the process of being refactored - and rightfully so.

May I ask the question if we could thus constrain this bug to controlling local login only, at least if LDAP is out of the question? This way we could expedite my patch which would be highly appreciated by our users ;)

Cheers