From 29de06b969a943a34f23f484314d124540df1b83 Mon Sep 17 00:00:00 2001 From: Leszek Grzanka Date: Thu, 1 Oct 2026 19:58:45 +0200 Subject: [PATCH 1/2] Document Keycloak-only instances in authentication docs Describe the ENABLE_USER_REGISTRATION and ENABLE_LOCAL_USERS backend variables that switch off local users (yaptide/yaptide#1676). Co-Authored-By: Claude Opus 5.5 --- docs/authentication.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/docs/authentication.md b/docs/authentication.md index 6544d0f..3b1202f 100644 --- a/docs/authentication.md +++ b/docs/authentication.md @@ -24,3 +24,12 @@ These variables needs to be provided to the docker compose files via the `.env` The backend propagates this variable to the `yaptide_flask` container, to be able to verify keycloak tokens. The frontend needs to know the URL of the keycloak server, so it can redirect the user to the login page. To properly setup these variables in case of ansible deployment, please use `yap_dev_vars.yml` as an example. + +## Keycloak-only instances + +Local users (the first method) can be switched off on the backend with these variables in the backend `.env` file: + + * `ENABLE_USER_REGISTRATION` - set to `false` to block self-registration of local users; existing local users can still log in. The docker compose file defaults it to `false`. + * `ENABLE_LOCAL_USERS` - set to `false` to allow only Keycloak users: local users can neither register nor log in, and their existing sessions are rejected. Defaults to `true`. + +The frontend needs no extra setting: it asks the backend whether local users are enabled and hides the "use password login" option when they are not. From 803b7a4260b1b744e69435ec63b1c790353790cc Mon Sep 17 00:00:00 2001 From: Leszek Grzanka Date: Thu, 1 Oct 2026 20:34:36 +0200 Subject: [PATCH 2/2] Document single ENABLE_LOCAL_USERS flag, disabled by default Co-Authored-By: Claude Opus 5.5 --- docs/authentication.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/docs/authentication.md b/docs/authentication.md index 3b1202f..5b80c7b 100644 --- a/docs/authentication.md +++ b/docs/authentication.md @@ -27,9 +27,10 @@ To properly setup these variables in case of ansible deployment, please use `yap ## Keycloak-only instances -Local users (the first method) can be switched off on the backend with these variables in the backend `.env` file: +Local users (the first method) are disabled by default: the backend accepts only Keycloak users unless the backend `.env` file sets - * `ENABLE_USER_REGISTRATION` - set to `false` to block self-registration of local users; existing local users can still log in. The docker compose file defaults it to `false`. - * `ENABLE_LOCAL_USERS` - set to `false` to allow only Keycloak users: local users can neither register nor log in, and their existing sessions are rejected. Defaults to `true`. + * `ENABLE_LOCAL_USERS=true` - allows local users to register and log in with a username and password. + +When the variable is unset or `false`, `/auth/register` and `/auth/login` return `403`, and sessions of local users are rejected. This also applies to the `admin` user created by the ansible playbook with `db_manage.py add-user`. The frontend needs no extra setting: it asks the backend whether local users are enabled and hides the "use password login" option when they are not.