Bug 38815 - Optionally block local login of accounts set for SSO
Summary: Optionally block local login of accounts set for SSO
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-01-02 18:30 UTC by Andrew Fuerste-Henry
Modified: 2025-01-02 18:30 UTC (History)
1 user (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Andrew Fuerste-Henry 2025-01-02 18:30:53 UTC
Bug 18506 added the ability to completely prevent local login (login using the koha username and password) when using SSO, but many libraries using SSO find it necessary to allow local login for some users or situations -- community borrowers at an academic library, support vendors who lack SSO credentials, etc.

If both SSO and local login must be allowed, libraries want to ensure that any given account can only log in one way -- if your account can authenticate via SSO, you should not be able to authenticate via local login. Libraries enforce this by setting NULL passwords in Koha on accounts using SSO, but at the very least any superlibrarian is able to change that password.

It would be helpful to be able to flag an account as "SSO only" and thereby force Koha to null the password and keep it null, hiding the Change Password button and the password field from patron edit.