Disable registration

[gramakri]

3.4.0 has added OIDC login. Would be great to add a way to disable registration . This way poll creators will login via OIDC . Poll voters can vote without login. Currently, there is ALLOWED_EMAILS but this is hard to maintain unless all the OIDC users have emails in a single domain.

[troplin]

Even better: an option to disable email-based login altogether and directly redirect to the OIDC login page instead.

[gramakri]

Agree with disabling the email login form entirely. But UI wise, I prefer a user to click the OIDC login button which then redirects. Otherwise, seeing a OIDC login screen in different domain when a user visited rallly.example.com can be confusing.

[wrycu]

It's been a bit but voicing my opinion here as well. It'd be lovely to fully disable registration - it's a bit jarring coming from rallly.co, loving the ease of use, setting it up for myself and finding out it's unusable without also requiring registration.

[dani]

Another vote fore the possibility to disable the email login form (and the register link) when oidc is configured. It confuses users. If disabled, there could just be a single button to trigger the oidc redirect

[lukevella]

My feeling about this is:

• It's a nice-to-have but not a must-have
• In the event that the identity provider is not working, users will not be able to login

The current implementation allows users to fallback to email login in case of a problem with the identity provider.

[icsy7867]

FWIW - At least for our onprem stuff, if SSO isnt working for our org, we have much bigger problems :D

[lukevella]

For sure! I meant that there could be an issue with the connection between the app and the identity provider. Could also be a bug in an app update. It's possible :)

[oliwel]

Its a must-have if you are running this with an eye on legal implications - we started using this for our NGO and if somebody puts his/her mail here, I am held responsible for all the nasty questions around GDPR. If I take that for serious (and our GDPR guy will if he gets to know it), I am forced to add legal documents and a support channel to get personal data removed...

[icsy7867]

Could we implement a way to add a custom javascript script to all pages? This could be useful here and other places.... for example:

• I could easily use javascript to hide the email login forms myself, accomplishing the same thing.
• I could potentially use javascript to automatically initiate OIDC login process without requiring the user to click the OIDC login button.
• I could detect a guest user, and force a redirect to the login page with the correct callback URL fairly easily.
• Change some layout functions, add some CSS, etc...

It would be nice to have either have a custom environment variable:
CUSTOM_JAVASCRIPT=/path/to/file.js

or an admin web panel with a small text box where a user could add:

<script>
my javascript stuff
</script>

I think a lot of these things are very easy to do with a small bit of javascript knowledge. This also takes the burden off yourself or other developers from having to implement/code every little change/want directly into the code.