Problem: Is there some way to disable the email login when using OIDC?

[Belugaking]

Issue

I've read through the documentation and I have semaphore set up with docker and my OIDC provider (Authentik), and everything works fine. However, I'd like to disable the email login where it seems that just anyone can put in an email to even just get an anonymous login. Preferably, I'd also like an option for the application to redirect to Authentik immediately instead of going to semaphore's login screen. Below is a screenshot of the email login I'm talking about:

Impact

Web-Frontend (what users interact with)

Configuration

OIDC Config:

  "oidc_providers": {
    "authentik": {
      "display_name": "Sign in with Authentik",
      "provider_url": "https://auth.my.domain/application/o/ansible-semaphore/",
      "client_id": "client_id",
      "client_secret": "client_secret",
      "redirect_url": "https://semaphore.my.domain/api/auth/oidc/authentik/redirect/",
      "scopes": ["openid", "profile", "email"],
      "username_claim": "preferred_username",
      "name_claim": "preferred_username"
    }
  }

Additional information

No response

[fiftin]

Hi @Belugaking yes, it is possible, there is env var SEMAPHORE_PASSWORD_LOGIN_DISABLED and config option password_login_disable for this.

[Belugaking]

I'm going to double check this when I get a chance, but is it really intended behavior for someone to be able to just log into my account if they know my email? That seems like a huge security risk for those that may want to use OIDC with internal login even just temporarily.

[Belugaking]

That fixed the original problem, however I do still get the actual username/password login.