Implement AUTH_DISABLE_DEFAULT config option

api/src/auth.ts

@@ -24,10 +24,12 @@ export function getAuthProvider(provider: string): AuthDriver {
 
 export async function registerAuthProviders(): Promise<void> {
 	const options = { knex: getDatabase(), schema: await getSchema() };
-	const defaultProvider = getProviderInstance('local', options)!;
 
-	// Register default provider
-	providers.set(DEFAULT_AUTH_PROVIDER, defaultProvider);
+	// Register default provider if not disabled
+	if (!env.AUTH_DISABLE_DEFAULT) {
+		const defaultProvider = getProviderInstance('local', options)!;
+		providers.set(DEFAULT_AUTH_PROVIDER, defaultProvider);
+	}
 
 	if (!env.AUTH_PROVIDERS) {
 		return;

api/src/controllers/auth.ts

@@ -48,7 +48,9 @@ for (const authProvider of authProviders) {
 	router.use(`/login/${authProvider.name}`, authRouter);
 }
 
-router.use('/login', createLocalAuthRouter(DEFAULT_AUTH_PROVIDER));
+if (!env.AUTH_DISABLE_DEFAULT) {
+	router.use('/login', createLocalAuthRouter(DEFAULT_AUTH_PROVIDER));
+}
 
 router.post(
 	'/refresh',
@@ -191,7 +193,10 @@ router.post(
 router.get(
 	'/',
 	asyncHandler(async (req, res, next) => {
-		res.locals.payload = { data: getAuthProviders() };
+		res.locals.payload = {
+			data: getAuthProviders(),
+			disableDefault: env.AUTH_DISABLE_DEFAULT,
+		};
 		return next();
 	}),
 	respond

api/src/env.ts

@@ -56,6 +56,7 @@ const defaults: Record<string, any> = {
 	CACHE_PERMISSIONS: true,
 
 	AUTH_PROVIDERS: '',
+	AUTH_DISABLE_DEFAULT: false,
 
 	EXTENSIONS_PATH: './extensions',
 

app/src/routes/login/login.vue

@@ -30,7 +30,7 @@
 
 <script lang="ts">
 import { useI18n } from 'vue-i18n';
-import { defineComponent, computed, PropType, ref, onMounted, watch } from 'vue';
+import { defineComponent, computed, PropType, ref, onMounted } from 'vue';
 import { LoginForm, LdapForm } from './components/login-form/';
 import ContinueAs from './components/continue-as.vue';
 import SsoLinks from './components/sso-links.vue';
@@ -74,19 +74,22 @@ export default defineComponent({
 
 		onMounted(() => fetchProviders());
 
-		watch(providers, () => {
-			providerOptions.value = providers.value
-				.filter((provider) => !AUTH_SSO_DRIVERS.includes(provider.driver))
-				.map((provider) => ({ text: formatTitle(provider.name), value: provider.name }));
-			providerOptions.value.unshift({ text: t('default_provider'), value: DEFAULT_AUTH_PROVIDER });
-		});
-
 		return { t, te, authenticated, providers, providerSelect, providerOptions, provider, driver };
 
 		async function fetchProviders() {
 			try {
 				const response = await api.get('/auth');
 				providers.value = response.data.data;
+
+				providerOptions.value = providers.value
+					.filter((provider) => !AUTH_SSO_DRIVERS.includes(provider.driver))
+					.map((provider) => ({ text: formatTitle(provider.name), value: provider.name }));
+
+				if (!response.data.disableDefault) {
+					providerOptions.value.unshift({ text: t('default_provider'), value: DEFAULT_AUTH_PROVIDER });
+				} else {
+					providerSelect.value = providerOptions.value[0]?.value;
+				}
 			} catch (err: any) {
 				unexpectedError(err);
 			}

docs/configuration/config-options.md

@@ -516,9 +516,10 @@ we recommend lowering the allowed concurrent transformations to prevent you from
 
 ## Authentication
 
-| Variable         | Description                            | Default Value |
-| ---------------- | -------------------------------------- | ------------- |
-| `AUTH_PROVIDERS` | CSV of auth providers you want to use. | --            |
+| Variable               | Description                            | Default Value |
+| ---------------------- | -------------------------------------- | ------------- |
+| `AUTH_PROVIDERS`       | CSV of auth providers you want to use. | --            |
+| `AUTH_DISABLE_DEFAULT` | Disable the default auth provider      | `false`       |
 
 For each of the auth providers you list, you must provide the following configuration:
 

docs/reference/authentication.md

@@ -397,6 +397,9 @@ To learn more about setting up auth providers, see
 `data` **Array**\
 Array of configured auth providers.
 
+`disableDefault` **boolean**\
+Whether or not the default authentication provider is disabled.
+
 </div>
 
 </div>
@@ -423,7 +426,8 @@ GET /auth
 			"name": "Okta",
 			"driver": "openid"
 		}
-	]
+	],
+	"disableDefault": false
 }
 ```