diff --git a/.env.example.complete b/.env.example.complete
index 0c7f8f6a5..c40ab1380 100644
--- a/.env.example.complete
+++ b/.env.example.complete
@@ -143,6 +143,10 @@ STORAGE_URL=false
# Can be 'standard', 'ldap', 'saml2' or 'oidc'
AUTH_METHOD=standard
+# Automatically initiate login via external auth system if it's the only auth method.
+# Works with saml2 or oidc auth methods.
+AUTH_AUTO_INITIATE=false
+
# Social authentication configuration
# All disabled by default.
# Refer to https://www.bookstackapp.com/docs/admin/third-party-auth/
diff --git a/app/Config/auth.php b/app/Config/auth.php
index 1e1a9d350..37190156a 100644
--- a/app/Config/auth.php
+++ b/app/Config/auth.php
@@ -13,6 +13,10 @@ return [
// Options: standard, ldap, saml2, oidc
'method' => env('AUTH_METHOD', 'standard'),
+ // Automatically initiate login via external auth system if it's the sole auth method.
+ // Works with saml2 or oidc auth methods.
+ 'auto_initiate' => env('AUTH_AUTO_INITIATE', false),
+
// Authentication Defaults
// This option controls the default authentication "guard" and password
// reset options for your application.
diff --git a/app/Http/Controllers/Auth/LoginController.php b/app/Http/Controllers/Auth/LoginController.php
index 742e10472..f1a1a8bd6 100644
--- a/app/Http/Controllers/Auth/LoginController.php
+++ b/app/Http/Controllers/Auth/LoginController.php
@@ -25,17 +25,16 @@ class LoginController extends Controller
|
*/
- use AuthenticatesUsers;
+ use AuthenticatesUsers { logout as traitLogout; }
/**
* Redirection paths.
*/
protected $redirectTo = '/';
protected $redirectPath = '/';
- protected $redirectAfterLogout = '/login';
- protected $socialAuthService;
- protected $loginService;
+ protected SocialAuthService $socialAuthService;
+ protected LoginService $loginService;
/**
* Create a new controller instance.
@@ -50,7 +49,6 @@ class LoginController extends Controller
$this->loginService = $loginService;
$this->redirectPath = url('/');
- $this->redirectAfterLogout = url('/login');
}
public function username()
@@ -73,6 +71,7 @@ class LoginController extends Controller
{
$socialDrivers = $this->socialAuthService->getActiveDrivers();
$authMethod = config('auth.method');
+ $preventInitiation = $request->get('prevent_auto_init') === 'true';
if ($request->has('email')) {
session()->flashInput([
@@ -84,6 +83,12 @@ class LoginController extends Controller
// Store the previous location for redirect after login
$this->updateIntendedFromPrevious();
+ if (!$preventInitiation && $this->shouldAutoInitiate()) {
+ return view('auth.login-initiate', [
+ 'authMethod' => $authMethod,
+ ]);
+ }
+
return view('auth.login', [
'socialDrivers' => $socialDrivers,
'authMethod' => $authMethod,
@@ -251,4 +256,32 @@ class LoginController extends Controller
redirect()->setIntendedUrl($previous);
}
+
+ /**
+ * Check if login auto-initiate should be valid based upon authentication config.
+ */
+ protected function shouldAutoInitiate(): bool
+ {
+ $socialDrivers = $this->socialAuthService->getActiveDrivers();
+ $authMethod = config('auth.method');
+ $autoRedirect = config('auth.auto_initiate');
+
+ return $autoRedirect && count($socialDrivers) === 0 && in_array($authMethod, ['oidc', 'saml2']);
+ }
+
+ /**
+ * Logout user and perform subsequent redirect.
+ *
+ * @param \Illuminate\Http\Request $request
+ *
+ * @return mixed
+ */
+ public function logout(Request $request)
+ {
+ $this->traitLogout($request);
+
+ $redirectUri = $this->shouldAutoInitiate() ? '/login?prevent_auto_init=true' : '/';
+
+ return redirect($redirectUri);
+ }
}
diff --git a/phpunit.xml b/phpunit.xml
index 90320ff41..56a510b10 100644
--- a/phpunit.xml
+++ b/phpunit.xml
@@ -29,6 +29,7 @@
{{ trans('auth.auto_init_starting_desc') }}
++ +
+