jujugui login should not show "Login with USSO" w/o an external identity config

[mitechie]

When you go to log into the Juju GUI you have two buttons as options, "Login" and "Login with USSO". However, the second button is only valid if you have an external identity provider. In fact, in that case you shouldn't have the option to enter the username/password really as you need to go through the external identity provider in order to log in anyway.

I propose that the Juju GUI gain access to if an external identity provider is provided as part of the controller config [1] and updates the login UX accordingly. In this way users are guided towards success.

This may require an updated to the Juju controller and perhaps we'll need some usable api call to provide what type of authentications are available on this controller if we cannot make an unauthorized api call to the controller in order to get the basic controller config. It seems like this is reasonable public knowledge data that one should be able to get before auth.

1: https://lists.ubuntu.com/archives/juju/2016-September/007843.html

[frankban]

I agree, we need to obtain that information from the controller before authenticating. I am not sure we ever want to hide the ability to log in with username and passwd: as an admin of that controller, or just as a local user, I might want to use both auth paths.

[mitechie]

True enough on the might want to use the username/password, but if an external provider is there I think it might be worth at least hiding it behind a "local user login" link or something that's there, but non-obvious. If someone has setup external identity support I feel like the local would be the exception to the rule vs the default use case.

[urosj]

If controller is set up with identity provider and fields are empty when one clicks login, then we can use that as a cue to go to that external provider and not bother with local users. If fields are non-empty, we take it as a local user. And we can only live with one login button.

[mitechie]

My concern with that plan is that will users know to not both typing in a password to level the external identity?

[urosj]

We can give visual hints. Empty fields, button shows "login with sso", and fields could have greyish background text "login as local user". Once user types something into username field, button shows "local user login". Something along these lines.

[frankban]

We don't currently have the information required for knowing if we can hide the Login with USSO button. In the meanwhile, we could certainly do better UX wise, for instance by separating the login mask in two section, for instance the userpass inputs + the traditional login button on the left, a more structured/explained USSO section on the right.

[frankban]

@wallyworld is working on adding the ability to make anonymous API calls to Juju. This is done as part of the CMR work. Maybe this can be extended to include the information that we need here?