implements #1007 - Option to

disable local login when OIDC is enabled

- Add GOTIFY_LOCALAUTH_ENABLED, defaulting to true
- Block local login and Basic Auth when disabled
- Expose local auth state to the UI and hide local login flows
- Skip default local admin creation when local auth is disabled
- Require either local auth or OIDC at startup

Author: DerDummePunkt

app.go

@@ -85,6 +85,9 @@ func serve(vInfo *model.VersionInfo) int {
 	conf, futureLogs := config.Get()
 	log.Logger = log.Output(zerolog.ConsoleWriter{Out: os.Stdout, TimeFormat: time.RFC3339, NoColor: noColor(conf.NoColor)}).Level(zerolog.Level(conf.LogLevel))
 	log.Info().Str("version", vInfo.Version).Str("build_date", BuildDate).Msg("Gotify")
+	if !conf.LocalAuthEnabled && !conf.OIDC.Enabled {
+		log.Fatal().Msg("either local authentication or OIDC must be enabled")
+	}
 
 	exit := false
 	for _, futureLog := range futureLogs {
@@ -106,7 +109,7 @@ func serve(vInfo *model.VersionInfo) int {
 		return 1
 	}
 
-	db, err := database.New(conf.Database.Dialect, conf.Database.Connection, conf.DefaultUser.Name, conf.DefaultUser.Pass, conf.PassStrength, true, time.Now)
+	db, err := database.New(conf.Database.Dialect, conf.Database.Connection, conf.DefaultUser.Name, conf.DefaultUser.Pass, conf.PassStrength, conf.LocalAuthEnabled, time.Now)
 	if err != nil {
 		log.Error().Err(err).Msg("Cannot initialize database")
 		return 1

auth/authentication.go

@@ -39,9 +39,10 @@ type Database interface {
 
 // Auth is the provider for authentication middleware.
 type Auth struct {
-	DB           Database
-	SecureCookie bool
-	CrossOrigin  *http.CrossOriginProtection
+	DB               Database
+	SecureCookie     bool
+	LocalAuthEnabled bool
+	CrossOrigin      *http.CrossOriginProtection
 }
 
 // RequireAdmin requires an elevated client token or basic auth, the user must be an admin.
@@ -146,6 +147,9 @@ func (a *Auth) rejectForeignOrigin(ctx *gin.Context) bool {
 
 func (a *Auth) handleUser(checks ...func(*model.User) (authState, error)) func(ctx *gin.Context) (authState, error) {
 	return func(ctx *gin.Context) (authState, error) {
+		if !a.LocalAuthEnabled {
+			return authStateSkip, nil
+		}
 		if name, pass, ok := ctx.Request.BasicAuth(); ok {
 			if user, err := a.DB.GetUserByName(name); err != nil {
 				return authStateSkip, err

auth/authentication_test.go

@@ -29,7 +29,7 @@ type AuthenticationSuite struct {
 func (s *AuthenticationSuite) SetupSuite() {
 	mode.Set(mode.TestDev)
 	s.DB = testdb.NewDB(s.T())
-	s.auth = &Auth{DB: s.DB, CrossOrigin: http.NewCrossOriginProtection()}
+	s.auth = &Auth{DB: s.DB, LocalAuthEnabled: true, CrossOrigin: http.NewCrossOriginProtection()}
 
 	now := time.Date(2025, 1, 1, 12, 0, 0, 0, time.UTC)
 	timeNow = func() time.Time { return now }
@@ -270,6 +270,15 @@ func (s *AuthenticationSuite) TestBasicAuth() {
 	s.assertHeaderRequest("Authorization", "Basic bm90ZXhpc3Rpbmc6cHc=", s.auth.RequireElevatedClient, 401)
 }
 
+func (s *AuthenticationSuite) TestBasicAuthDisabled() {
+	s.auth.LocalAuthEnabled = false
+	defer func() { s.auth.LocalAuthEnabled = true }()
+
+	s.assertHeaderRequest("Authorization", "Basic YWRtaW46cHc=", s.auth.RequireClient, 401)
+	s.assertHeaderRequest("Authorization", "Basic YWRtaW46cHc=", s.auth.RequireAdmin, 401)
+	s.assertHeaderRequest("Authorization", "Basic YWRtaW46cHc=", s.auth.RequireElevatedClient, 401)
+}
+
 func (s *AuthenticationSuite) TestOptionalAuth() {
 	// various invalid users
 	ctx := s.assertQueryRequest("token", "ergerogerg", s.auth.Optional, 200)

config/config.go

@@ -79,6 +79,7 @@ type Configuration struct {
 	UploadedImagesDir string
 	PluginsDir        string
 	Registration      bool
+	LocalAuthEnabled  bool
 	OIDC              OIDC
 	NoColor           string
 }
@@ -111,6 +112,7 @@ func Get() (*Configuration, []FutureLog) {
 		PassStrength:      10,
 		UploadedImagesDir: "data/images",
 		PluginsDir:        "data/plugins",
+		LocalAuthEnabled:  true,
 		OIDC: OIDC{
 			UsernameClaim: "preferred_username",
 			AutoRegister:  true,
@@ -167,6 +169,7 @@ func Get() (*Configuration, []FutureLog) {
 	add(parseString(&c.UploadedImagesDir, EnvUploadedImagesDir))
 	add(parseString(&c.PluginsDir, EnvPluginsDir))
 	add(parseBool(&c.Registration, EnvRegistration))
+	add(parseBool(&c.LocalAuthEnabled, EnvLocalAuthEnabled))
 
 	add(parseBool(&c.OIDC.Enabled, EnvOIDCEnabled))
 	add(parseString(&c.OIDC.Issuer, EnvOIDCIssuer))

config/config_test.go

@@ -20,6 +20,7 @@ func TestConfigEnv(t *testing.T) {
 	os.Setenv("GOTIFY_SERVER_CORS_ALLOWMETHODS", "GET,POST")
 	os.Setenv("GOTIFY_SERVER_CORS_ALLOWHEADERS", "Authorization,content-type")
 	os.Setenv("GOTIFY_SERVER_STREAM_ALLOWEDORIGINS", ".+.example.com,otherdomain.com")
+	t.Setenv(EnvLocalAuthEnabled, "false")
 
 	defer func() {
 		os.Unsetenv("GOTIFY_DEFAULTUSER_NAME")
@@ -41,6 +42,7 @@ func TestConfigEnv(t *testing.T) {
 	assert.Equal(t, []string{"GET", "POST"}, conf.Server.Cors.AllowMethods)
 	assert.Equal(t, []string{"Authorization", "content-type"}, conf.Server.Cors.AllowHeaders)
 	assert.Equal(t, []string{".+.example.com", "otherdomain.com"}, conf.Server.Stream.AllowedOrigins)
+	assert.False(t, conf.LocalAuthEnabled)
 }
 
 func TestFile(t *testing.T) {

config/keys.go

@@ -40,6 +40,7 @@ const (
 	EnvOIDCRedirectURL                  = "GOTIFY_OIDC_REDIRECTURL"
 	EnvOIDCAutoRegister                 = "GOTIFY_OIDC_AUTOREGISTER"
 	EnvOIDCLinkByUsername               = "GOTIFY_OIDC_LINK_BY_USERNAME"
+	EnvLocalAuthEnabled                 = "GOTIFY_LOCALAUTH_ENABLED"
 	EnvOIDCScopes                       = "GOTIFY_OIDC_SCOPES"
 	EnvNoColor                          = "NOCOLOR"
 )

docs/spec.json

@@ -2940,9 +2940,16 @@
       "required": [
         "version",
         "register",
+        "localauth",
         "oidc"
       ],
       "properties": {
+        "localauth": {
+          "description": "If local authentication is enabled.",
+          "type": "boolean",
+          "x-go-name": "LocalAuth",
+          "example": true
+        },
         "oidc": {
           "description": "If oidc is enabled.",
           "type": "boolean",

gotify-server.env.example

@@ -224,6 +224,13 @@
 # Type: text-list
 # GOTIFY_OIDC_SCOPES=openid,profile,email
 
+# Enable authentication via username and password.
+# At least one of GOTIFY_LOCALAUTH_ENABLED or GOTIFY_OIDC_ENABLED must be set to
+# true to allow users to login. Otherwise the server will refuse to start.
+#
+# Type: boolean
+# GOTIFY_LOCALAUTH_ENABLED=true
+
 # Database driver to use. For mysql and postgres the target database must
 # already exist and the configured user must have sufficient permissions.
 #

model/gotifyinfo.go

@@ -14,6 +14,11 @@ type GotifyInfo struct {
 	// required: true
 	// example: true
 	Register bool `json:"register"`
+	// If local authentication is enabled.
+	//
+	// required: true
+	// example: true
+	LocalAuth bool `json:"localauth"`
 	// If oidc is enabled.
 	//
 	// required: true

router/router.go

@@ -85,9 +85,10 @@ func Create(db *database.GormDatabase, vInfo *model.VersionInfo, conf *config.Co
 		}
 	}()
 	authentication := auth.Auth{
-		DB:           db,
-		SecureCookie: conf.Server.SecureCookie,
-		CrossOrigin:  http.NewCrossOriginProtection(),
+		DB:               db,
+		SecureCookie:     conf.Server.SecureCookie,
+		LocalAuthEnabled: conf.LocalAuthEnabled,
+		CrossOrigin:      http.NewCrossOriginProtection(),
 	}
 	messageHandler := api.MessageAPI{Notifier: streamHandler, DB: db}
 	healthHandler := api.HealthAPI{DB: db}
@@ -118,7 +119,7 @@ func Create(db *database.GormDatabase, vInfo *model.VersionInfo, conf *config.Co
 	userChangeNotifier.OnUserDeleted(pluginManager.RemoveUser)
 	userChangeNotifier.OnUserAdded(pluginManager.InitializeForUserID)
 
-	ui.Register(g, *vInfo, conf.Registration, conf.OIDC.Enabled)
+	ui.Register(g, *vInfo, conf.Registration, conf.LocalAuthEnabled, conf.OIDC.Enabled)
 
 	if conf.OIDC.Enabled {
 		oidcHandler := api.NewOIDC(conf, db, userChangeNotifier)
@@ -158,7 +159,9 @@ func Create(db *database.GormDatabase, vInfo *model.VersionInfo, conf *config.Co
 
 	g.Group("/user").Use(authentication.Optional).POST("", userHandler.CreateUser)
 
-	g.POST("/auth/local/login", sessionHandler.Login)
+	if conf.LocalAuthEnabled {
+		g.POST("/auth/local/login", sessionHandler.Login)
+	}
 
 	g.OPTIONS("/*any")
 
@@ -189,7 +192,7 @@ func Create(db *database.GormDatabase, vInfo *model.VersionInfo, conf *config.Co
 	//     schema:
 	//         $ref: "#/definitions/GotifyInfo"
 	g.GET("gotifyinfo", func(ctx *gin.Context) {
-		ctx.JSON(200, &model.GotifyInfo{Version: vInfo.Version, Oidc: conf.OIDC.Enabled, Register: conf.Registration})
+		ctx.JSON(200, &model.GotifyInfo{Version: vInfo.Version, Oidc: conf.OIDC.Enabled, Register: conf.Registration, LocalAuth: conf.LocalAuthEnabled})
 	})
 
 	g.Group("/").Use(authentication.RequireApplicationOrClient).POST("/message", messageHandler.CreateMessage)