When setting up identity provides (OAuth/OpenID) you can enable or disable the provider for the OPAC/Staff client We have the preferences OPACShibOnly and staffShibOnly which will limit everything to Shib It would be nice to instead have a switch for each: OpacEnableLocalLogin OpacEnableCASLogin OpacEnableShibLogin OpacEnableLDAPLogin and staff equivalents additionally - when using identity providers they always add the line: <p>If you do not have an external account, but do have a local account, you can still log in: </p> This needs a class at minimum, but should likely be removed and allow the library to specify the text in loginInstructions html customization
100% agreed with all of this
Just to vote this up a notch! I'm particularly interested in OpacEnableLocalLogin since leaving local login enabled after having switched to OIDC-based SSO is just confusing our users. Thanks
Looking into a patch for OpacEnableLocalLogin...
Created attachment 185341 [details] [review] Added OpacEnableLocalLogin/StaffEnableLocalLogin to disable local logins Ok, as promised, here's a first patch. I omitted whitespace changes (indentations) to facilitate the patch discussion. Let me know if you want to go forward with this. Note: what's missing is the corresponding DB rev upgrade. Cheers
(In reply to Nick Clemens (kidclamp) from comment #0) > It would be nice to instead have a switch for each: > [...] > OpacEnableShibLogin > OpacEnableLDAPLogin These two are effectively managed in koha-conf.xml [1], presumably since they need further config entries that sysprefs are probably not tailored for. Do you suggest to move those to the sysprefs anyway? Cheers [1] https://git.koha-community.org/Koha-community/Koha/src/commit/3ea3c2a27a9e7fad62a30486826f0a1ce3740ace/etc/koha-conf.xml#L105
(In reply to Nick Clemens (kidclamp) from comment #0) > It would be nice to instead have a switch for each: > [...] > OpacEnableCASLogin How would that differ from the existing "casAuthentication"? Thanks
Thanks @tcohen for referencing bug 40596! That means CAS and Shibboleth are already in the process of being refactored - and rightfully so. May I ask the question if we could thus constrain this bug to controlling local login only, at least if LDAP is out of the question? This way we could expedite my patch which would be highly appreciated by our users ;) Cheers