Enable LDAP and SAML authentication support

services/web/app/src/Features/Authentication/AuthenticationController.mjs

@@ -128,9 +128,9 @@ const AuthenticationController = {
     // so we can send back our custom `{message: {text: "", type: ""}}` responses on failure,
     // and send a `{redir: ""}` response on success
     passport.authenticate(
-      'local',
+      Settings.ldap?.enable ? ['custom-fail-ldapauth','local'] : ['local'],
       { keepSessionInfo: true },
-      async function (err, user, info) {
+      async function (err, user, infoArray) {
         if (err) {
           return next(err)
         }
@@ -152,6 +152,7 @@ const AuthenticationController = {
             return next(err)
           }
         } else {
+	  let info = infoArray[0]
           if (info.redir != null) {
             return res.json({ redir: info.redir })
           } else {

services/web/app/src/Features/PasswordReset/PasswordResetController.mjs

@@ -158,6 +158,10 @@ async function requestReset(req, res, next) {
     return res.status(404).json({
       message: req.i18n.translate('secondary_email_password_reset'),
     })
+  } else if (status === 'external') {
+    return res.status(403).json({
+      message: req.i18n.translate('password_managed_externally'),
+    })
   } else {
     return res.status(404).json({
       message: req.i18n.translate('cant_find_email'),

services/web/app/src/Features/PasswordReset/PasswordResetHandler.mjs

@@ -18,6 +18,10 @@ async function generateAndEmailResetToken(email) {
     return null
   }
 
+  if (!user.hashedPassword) {
+    return 'external'
+  }
+
   if (user.email !== email) {
     return 'secondary'
   }

services/web/app/src/Features/User/UserController.mjs

@@ -453,7 +453,7 @@ async function updateUserSettings(req, res, next) {
   if (
     newEmail == null ||
     newEmail === user.email ||
-    req.externalAuthenticationSystemUsed()
+    (req.externalAuthenticationSystemUsed() && !user.hashedPassword)
   ) {
     // end here, don't update email
     SessionManager.setInSessionUser(req.session, {
@@ -540,6 +540,7 @@ async function doLogout(req) {
 }
 
 async function logout(req, res, next) {
+  if (req?.session.saml_extce) return res.redirect(308, '/saml/logout')
   const requestedRedirect = req.body.redirect
     ? UrlHelper.getSafeRedirectPath(req.body.redirect)
     : undefined

services/web/app/views/user/login.pug

@@ -26,8 +26,9 @@ block content
 							label(for='email') #{translate("email")}
 							input#email.form-control(
 								name='email'
-								type='email'
+								type=(settings.ldap && settings.ldap.enable) ? 'text' : 'email'
 								required
+								placeholder=(settings.ldap && settings.ldap.enable) ? settings.ldap.placeholder : 'email@example.com'
 								autofocus='true'
 								autocomplete='username'
 							)
@@ -47,3 +48,12 @@ block content
 						if login_support_text
 							hr
 							p.text-center !{login_support_text}
+					if settings.saml && settings.saml.enable
+						form(data-ol-async-form, name="samlLoginForm")
+							.actions(style='margin-top: 30px;')
+								a.btn.btn-secondary.btn-block(
+									href='/saml/login',
+									data-ol-disabled-inflight
+								)
+									span(data-ol-inflight="idle") #{settings.saml.identityServiceName}
+									span(hidden data-ol-inflight="pending") #{translate("logging_in")}…

services/web/app/views/user/settings.pug

@@ -11,7 +11,7 @@ block append meta
 	meta(
 		name='ol-shouldAllowEditingDetails'
 		data-type='boolean'
-		content=shouldAllowEditingDetails
+		content=shouldAllowEditingDetails || hasPassword
 	)
 	meta(name='ol-oauthProviders' data-type='json' content=oauthProviders)
 	meta(name='ol-institutionLinked' data-type='json' content=institutionLinked)
@@ -34,7 +34,7 @@ block append meta
 	meta(
 		name='ol-isExternalAuthenticationSystemUsed'
 		data-type='boolean'
-		content=externalAuthenticationSystemUsed()
+		content=externalAuthenticationSystemUsed() && !hasPassword
 	)
 	meta(name='ol-user' data-type='json' content=user)
 	meta(name='ol-showAiFeatures' data-type='boolean' content=showAiFeatures)