Disable password login

[thelan]

Hello,

I think it should be handy to have an option to disable password login.

For instance i'm using OIDC SSO for auth and would like to hide the "username / password" form from the login page to avoid users confusion.

[rcourtman]

Implemented in commit 6b84b9a.

Added a new environment variable PULSE_AUTH_HIDE_LOCAL_LOGIN=true that hides the username/password form from the login page when you're using OIDC SSO.

How to use:
Add this to your .env file:

PULSE_AUTH_HIDE_LOCAL_LOGIN=true

This will hide the local login form, showing only the "Continue with Single Sign-On" button.

Safety feature: If you ever need to access the local login form (e.g., if OIDC is down), you can add ?show_local=true to the URL:

https://your-pulse-instance/login?show_local=true

This approach avoids the security and upgrade issues that led to DISABLE_AUTH being removed, while solving your UX concern about user confusion.

[thelan]

😱 That was fast edit.

Actually that sounds find to me.

Thank-you your awesome :)

[thelan]

Maybe you should also hide the title ?

[BatisteDONDOGLIO]

Safety feature: If you ever need to access the local login form (e.g., if OIDC is down), you can add ?show_local=true to the URL:

https://your-pulse-instance/login?show_local=true

This approach avoids the security and upgrade issues that led to DISABLE_AUTH being removed, while solving your UX concern about user confusion.

I think you meant https://your-pulse-instance/?show_local=true ? Because /login?show_local=true results in a blank page for me. But /?show_local=true works as expected.

And I also agree with this:

Maybe you should also hide the title ?

Thanks tho! This is very useful.

[rcourtman]

Both points addressed in commit 22dac34:

1. URL path: Fixed the documentation in docs/OIDC.md - the correct URL is /?show_local=true (not /login?show_local=true since there's no /login route in this SPA)

2. Subtitle: The "Enter your credentials to continue" subtitle is now hidden when local login is hidden, since it doesn't make sense when there's no credential form

The "Welcome to Pulse" title remains visible since it's generic and still appropriate for the SSO flow.

Will be in the next release.

[BatisteDONDOGLIO]

Thanks, @rcourtman

However, it doesn't seem to be working correctly. On build 4.34.0, the behavior is as follows:

The toggleable switch "Hide local login form" under Settings > Security > Authentication does not seem to stick and isn't being applied correctly, as the login form is still showing. Simply enabling and refreshing the page will result in it being toggled off again.

Manually setting

"hideLocalLogin":true

in system.json makes the toggle switch to the correct state, visually speaking, however, the login form still isn't hidden.

It seems only setting the environment variable PULSE_AUTH_HIDE_LOCAL_LOGIN=true hides the login form, but the message "Or use your admin credentials to sign in below" is still showing in this case.

[rcourtman]

Fixed in commit 8afc4d0.

The issues were:

1. The backend HandleUpdateSystemSettings() wasn't processing the hideLocalLogin field, so toggle changes weren't saved
2. The "or" divider and "Use your admin credentials" message weren't conditionally hidden when local login is hidden

Both are now fixed. Will be in the next release.