Extend configuration for external users / anonymous accounts

[bastf]

Hi,

I'm considering hosting scrumlr.io on my own infrastructure and have encountered a potential limitation I'd like to discuss.

My requirements are:

• Allow authenticated users (via OIDC) to log in and create new boards.
• Allow anonymous users to join existing boards, but prevent them from creating new ones.

As far as I understand, setting the environment variable SCRUMLR_DISABLE_ANONYMOUS_LOGIN=true disables all anonymous access - including the ability to join existing boards. That would mean, in order to allow external participants in retrospectives, I would need to allow public users to create new boards - which is not acceptable for my setup.

It's possible I’ve overlooked something and this configuration is already supported. If not, is there a way to achieve this behavior with the current setup? Or would you consider adding more advanced configuration options to provide finer-grained control over anonymous access?

Thanks a lot for considering this feature request!

[Schwehn42]

Hi bastf,

you're correct this is indeed not possible as of now.
With the upcoming templates feature, it is possible to control whether anonymous accounts can create custom templates or only use recommended ones. In that sense, I think it's also sensible to add another flag to achieve what you've described.

I've created an issue (#5295) so you can follow the progress -- I cannot guarantee whether itll be in the next release, but surely in the one after that :) thanks for the suggestion!

[bastf]

Hi @Schwehn42, thank you for your quick reply and also for considering my request! I'm looking forward to having the option to disable guests to create new boards. :)

[bastf]

Hi @Schwehn42 - While testing the new release I noticed a minor thing regarding the error message for anonymous users when trying to create a new board. The error message appears while hovering the "Start" button: "To create a board, please sign in with your Google or Microsoft account". I would recommend the omit the two login providers, as there are other options available as well.

Thanks again for adding this feature! 👍