Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

loginlocalloginenable should only work with multiple auth methods #777

Open
stdoma opened this issue Nov 28, 2024 · 4 comments
Open

loginlocalloginenable should only work with multiple auth methods #777

stdoma opened this issue Nov 28, 2024 · 4 comments
Labels
good first issue Something which can be addressed by newcomers in reasonable time improvement Something which improves an existing feature in some way (UX, UI, Design, Functionality)

Comments

@stdoma
Copy link

stdoma commented Nov 28, 2024

Describe the bug
I have a small system where there are only manual accounts and no additional auth methods are activated.
If you set loginlocalloginenable to no, you have no way of logging into the system. This means that you can lock yourself out of the system.

The setting should only have an effect if there is at least one additional auth method to the manual accounts.

To Reproduce

  1. Log in as admin & set loginlocalloginenable to “no” in the Boost Union settings
  2. Deactivate all auth methods in the plugin settings
  3. Log out of the system
  4. Call up login page
@stdoma stdoma added the new Something which has been reported but has not yet beeen triaged by the team label Nov 28, 2024
@krostas1983
Copy link

krostas1983 commented Nov 28, 2024

The fallback you are asking for is linked in the help text to loginlocalloginenable and is accessible under <webroot>/theme/boost_union/locallogin.php

It is available for manual authentication as soon as you disable the local login form on the login page via the theme setting.

@stdoma
Copy link
Author

stdoma commented Nov 29, 2024

Thank you for the information.
I had a system yesterday where this happened because the setting was accidentally made by an admin.
I didn't have the info from the help text in my head and then solved the problem differently...

I think that a URL redirect to the separate login page would be good if no elements are displayed on the normal login page.

@wiebkemueller-hsh wiebkemueller-hsh added the improvement Something which improves an existing feature in some way (UX, UI, Design, Functionality) label Dec 5, 2024
@wiebkemueller-hsh
Copy link
Collaborator

Hello, thanks for mentionting.

There might be a way out if we posted a short note like the one screenshotted below (explaining the thing in the other way round) in case you logged yourself out and do not remember the info where to look for the seperate login form.

Text in this screenshot means roughly: "Local login is activated in the standard login form. It is not necessary to log in on this local login page. Please use the standard login page to log in."
/theme/boost_union/locallogin.php
grafik

@wiebkemueller-hsh wiebkemueller-hsh added discussion needed Something which needs to be discussed before writing the first line of code good first issue Something which can be addressed by newcomers in reasonable time and removed new Something which has been reported but has not yet beeen triaged by the team labels Dec 5, 2024
@wiebkemueller-hsh
Copy link
Collaborator

As discussed in the BU team, we favor the solution to put an explicit warning in the admin backend instead of marketing the back door as the new "front door".

ATTENTION: No other authentification methods are active, if you disable the local login form now, you can only access the system via the following URL: webroot/theme/boost_union/locallogin.php

ACHTUNG: Es sind keine weiteren Authentifizierungsmethoden aktiv, wenn Sie die lokale Anmeldeseite deaktivieren, ist das System nur noch über die folgende Adresse zugänglich: /theme/boost_union/locallogin.php

@wiebkemueller-hsh wiebkemueller-hsh removed the discussion needed Something which needs to be discussed before writing the first line of code label Dec 12, 2024
@wiebkemueller-hsh wiebkemueller-hsh moved this from To do REQ to Ready for DEV in Boost Union Planning Board Dec 12, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
good first issue Something which can be addressed by newcomers in reasonable time improvement Something which improves an existing feature in some way (UX, UI, Design, Functionality)
Projects
Status: Ready for DEV
Development

No branches or pull requests

3 participants