Skip to content

Allow password authentication to be disabled

Petr Stribny requested to merge 1317-disable-password-auth-2 into develop

This MR allows users to disable password authentication provider.

  • Password provider can be enabled/disabled in auth admin like other providers.
  • At least one auth provider has to be always enabled. It is not possible to delete or disable last enabled provider.
  • If password auth is disabled, the login/sign up forms are hidden.
  • If login form is hidden, it can be shown by clicking on a link below. In this case only instance admin is allowed to log in.
  • If only one auth provider is enabled and it is redirect-based (SAML, OAuth 2), the login page will redirect users automatically. This behavior can be bypassed by adding ?noredirect to the URL.
  • If multiple SAML providers are enabled but no other provider, then user will be redirected to the SAML login page to enter his email.

Merge Request Checklist

  • changelog.md has been updated if required
  • New/updated Premium features are separated correctly in the premium folder
  • The latest Chrome and Firefox have been used to test any new frontend features
  • Documentation has been updated
  • Quality Standards are met
  • Performance: tables are still fast with 100k+ rows, 100+ field tables
  • The redoc API pages have been updated for any REST API changes
  • Our custom API docs are updated for changes to endpoints accessed via api tokens
  • The UI/UX has been updated following UI Style Guide

Closes #1317 (closed)

Edited by Petr Stribny

Merge request reports