Is your feature request related to a problem? Please describe.
When OIDC SSO is enabled, the local username/password login form is still shown and the /auth/local/login endpoint stays active. In setups where all users should authenticate through the identity provider (centralized auth, MFA/policy enforced at the IdP, deprovisioning handled centrally), operators want to fully turn off local login so it can't be used as a bypass.
Describe the solution you'd like
A new boolean config option, e.g. GOTIFY_OIDC_DISABLELOCALLOGIN (default false). When it is true and OIDC is enabled:
- Backend rejects
POST /auth/local/login with 403 and a clear error instead of 404.
- UI hides the username/password form (and the register button), leaving only the "Login with OIDC" button.
/gotifyinfo reports local-login availability so clients can adapt.
Critical safety behavior: the flag must ONLY take effect when OIDC is actually enabled. If DISABLELOCALLOGIN=true but OIDC is disabled, the flag is ignored (local login stays working) and a warning is logged, so an operator can never lock themselves out.
Describe alternatives you've considered
- Reverse-proxy rules blocking
/auth/local/login: works but is external, easy to misconfigure, and doesn't hide the UI form.
- Removing local accounts entirely: not viable, a break-glass admin is often still wanted.
Additional context
We already have a working implementation on a local branch and are happy to open a PR if the maintainers are open to it. Rough scope:
config/keys.go, config/config.go: new env var + OIDC.DisableLocalLogin field.router/router.go: conditional /auth/local/login handler (403 when disabled) + ignore-with-warning guard.model/gotifyinfo.go, ui/serve.go: expose localLogin to clients/UI.ui/src/config.ts, ui/src/user/Login.tsx: hide form/register, keep OIDC button.- Docs (
gotify-server.env.example), swagger spec, and tests.
Happy to align with your preferred naming/behavior before submitting.
Is your feature request related to a problem? Please describe.
When OIDC SSO is enabled, the local username/password login form is still shown and the
/auth/local/loginendpoint stays active. In setups where all users should authenticate through the identity provider (centralized auth, MFA/policy enforced at the IdP, deprovisioning handled centrally), operators want to fully turn off local login so it can't be used as a bypass.Describe the solution you'd like
A new boolean config option, e.g.
GOTIFY_OIDC_DISABLELOCALLOGIN(defaultfalse). When it istrueand OIDC is enabled:POST /auth/local/loginwith403and a clear error instead of404./gotifyinforeports local-login availability so clients can adapt.Critical safety behavior: the flag must ONLY take effect when OIDC is actually enabled. If
DISABLELOCALLOGIN=truebut OIDC is disabled, the flag is ignored (local login stays working) and a warning is logged, so an operator can never lock themselves out.Describe alternatives you've considered
/auth/local/login: works but is external, easy to misconfigure, and doesn't hide the UI form.Additional context
We already have a working implementation on a local branch and are happy to open a PR if the maintainers are open to it. Rough scope:
config/keys.go,config/config.go: new env var +OIDC.DisableLocalLoginfield.router/router.go: conditional/auth/local/loginhandler (403 when disabled) + ignore-with-warning guard.model/gotifyinfo.go,ui/serve.go: exposelocalLoginto clients/UI.ui/src/config.ts,ui/src/user/Login.tsx: hide form/register, keep OIDC button.gotify-server.env.example), swagger spec, and tests.Happy to align with your preferred naming/behavior before submitting.