How disable general local login strategy

[kevinprotoss]

Hello,

I intend to implement a new oauth2 endpoint and use the oauth2 login plugin for nodebb, but I have a question, is it possible for me to disable the local login strategy or login page in the admin settings?

Best regards,
Kevin

[julian]

Not yet, but for now you can do this by hiding the routes for POST /login and /register, and also by removing the local login elements from the login.tpl as well.

Perhaps we can add a toggle to remove local logins in the forum settings... @baris, what do you think?

[Sp4rkR4t]

It would be nice to have a toggle in the ACP but make sure you have a big warning next to it.

[baris]

add option in ACP to disable local logins · Issue #1232 · NodeBB/NodeBB

should hide the local login elements in login.tpl should disable /login /register routes.

GitHub (github.com)

[julian]

I think we can actually also use plugins.getListeners to ensure that alternative login strategies exist, and hide the option accordingly

[kevinprotoss]

To disable the local login, must I remove the routes for /login und /register? What do you mean 'hiding' @julian ? Or just fork and modify the theme, e.g., remove login.tpl and link in the menu.tpl?
If so, which theme should I modify? Will the templates in the lavanda overwrite those of in the vanilla?

[julian]

@kevinprotoss Lavender is a child theme of Vanilla, so if the template is present in lavender, it will overwrite vanilla. Likewise, if the template doesn't exist in Lavender, then Vanilla's .tpl file is used.

[kevinprotoss]

@julian I see. That's what I mean. If I wanna completely disable the /login and /register route for NodeBB, must I modify the source code of NodeBB? Is there any other possibilities?

[julian]

You can comment out these lines, and also these lines

I thought about adding an option to toggle turning on and off the login routing and template, but I'm afraid it would be too easy to lock yourself out if your SSO login stopped working altogether.

[kevinprotoss]

@julian Thanks your cue. You are absolutely right. If it's just a toggle, then it will be a dead lock. Is it possible to make it as a bootstrap config?

[kevinprotoss]

@julian Is it possible to just add a toggle in the plugin's admin page and works only for this plugin. If the oauth2 server is down, just remove the plugins temporarily. I have a doubt whether NodeBB has already a safe mode start, this means starting without all the plugins ?

[julian]

@kevinprotoss That's a good point -- we do, actually. ./nodebb reset will disable all plugins and reset the theme to vanilla. We can easily extend this to also re-enable local logins as well.

Okay, let's make it an issue.

[a_5mith]

So, I just spotted this option in the ACP.... Needless to say I've managed to lock myself out. Help? Anyway to turn it back on from Terminal? (Not on a live server, don't panic)

[baris]

@a_5mith ./nodebb reset settings

[julian]

Thank god @baris accounts for people like you @a_5mith

[a_5mith]

Well, that was embarrassing, thanks @baris.

@julian, someone's got to test these sorts of things. All good now.