Defaults to {@code true} so existing installs are unaffected. Set it to + * false on deployments that front DeepSQL with Google Workspace SSO: enabling + * SSO does NOT by itself close the password path, so without this flag + * {@code /auth/login} stays open to every local account even when every human + * signs in through Google. + * + *
Turning this off while {@code security.google.enabled} is also off leaves + * no way to sign in — {@link #warnIfNoAuthMethodEnabled()} shouts about that at + * startup rather than letting it be discovered at the login screen. + */ + @Value("${security.password.enabled:true}") + private boolean passwordLoginEnabled; + + @PostConstruct + void warnIfNoAuthMethodEnabled() { + if (!passwordLoginEnabled && !googleEnabled) { + log.error("security.password.enabled=false AND security.google.enabled=false — " + + "no sign-in method is available and nobody can log in. Enable one of them."); + } else if (!passwordLoginEnabled) { + log.info("Password sign-in is DISABLED (security.password.enabled=false); Google SSO only."); + } + } + @Value("${security.google.client-id:}") private String googleClientId; @@ -87,6 +116,23 @@ public class PasswordlessAuthService { @Transactional public AuthFlowResult loginWithPassword(String email, String password, String clientIp, String userAgent, String requestId) { String normalizedEmail = normalizeEmail(email); + + // Checked before the rate limiter and before any credential comparison: + // when the password path is closed there is nothing to rate-limit and no + // secret to compare, and we must not leak whether the account exists. + if (!passwordLoginEnabled) { + securityEventService.log(SecurityEventService.EventRequest.builder() + .eventType(SecurityEventType.PASSWORD_LOGIN_FAILURE) + .outcome(SecurityEventOutcome.FAILURE) + .email(normalizedEmail) + .clientIp(clientIp) + .userAgent(userAgent) + .requestId(requestId) + .metadata(Map.of("reason", "password_login_disabled")) + .build()); + return AuthFlowResult.invalid("Password sign-in is disabled. Please sign in with Google."); + } + if (rateLimitEnabled) enforcePasswordRateLimit(normalizedEmail, clientIp); User user = normalizedEmail == null ? null : userRepository.findByEmailIgnoreCase(normalizedEmail).orElse(null); diff --git a/backend/src/main/resources/application-prod.properties b/backend/src/main/resources/application-prod.properties index 065d3c4..8cf8390 100644 --- a/backend/src/main/resources/application-prod.properties +++ b/backend/src/main/resources/application-prod.properties @@ -7,6 +7,7 @@ spring.threads.virtual.enabled=true # Security Configuration - set to false to bypass authentication security.auth.enabled=true +security.password.enabled=${SECURITY_PASSWORD_ENABLED:true} security.jwt.secret=${SECURITY_JWT_SECRET:} # First-user bootstrap. Off by default: the endpoint creates an ADMIN without # authenticating, so it stays shut unless someone is deliberately installing. diff --git a/backend/src/main/resources/application.properties b/backend/src/main/resources/application.properties index 02057fb..befdb2a 100644 --- a/backend/src/main/resources/application.properties +++ b/backend/src/main/resources/application.properties @@ -16,6 +16,9 @@ spring.threads.virtual.enabled=true # matches production behavior. Override with SECURITY_AUTH_ENABLED=false only # for explicit single-user bypass scenarios. security.auth.enabled=${SECURITY_AUTH_ENABLED:true} +# Email+password sign-in. Defaults true so existing installs are unaffected. +# Set false on SSO-only deployments: enabling Google does NOT close /auth/login. +security.password.enabled=${SECURITY_PASSWORD_ENABLED:true} security.admin-mfa.enabled=${SECURITY_ADMIN_MFA_ENABLED:false} security.jwt.secret=${SECURITY_JWT_SECRET:} security.admin.bootstrap.enabled=${SECURITY_ADMIN_BOOTSTRAP_ENABLED:false} diff --git a/backend/src/test/java/com/dbaagent/service/PasswordlessAuthServiceTest.java b/backend/src/test/java/com/dbaagent/service/PasswordlessAuthServiceTest.java index 8246ecb..29bd3bd 100644 --- a/backend/src/test/java/com/dbaagent/service/PasswordlessAuthServiceTest.java +++ b/backend/src/test/java/com/dbaagent/service/PasswordlessAuthServiceTest.java @@ -57,6 +57,11 @@ void setUp() { ReflectionTestUtils.setField(service, "maxIpStarts", 20); ReflectionTestUtils.setField(service, "maxPasswordFailures", 10); ReflectionTestUtils.setField(service, "adminMfaEnabled", false); + // @Value is not processed by @InjectMocks, so a boolean field defaults to + // false. Unlike rateLimitEnabled (checked as `if (enabled)`, so absence + // merely skips it), password login is checked as `if (!enabled)` — leaving + // it unset would reject every login below. + ReflectionTestUtils.setField(service, "passwordLoginEnabled", true); when(authLoginChallengeRepository.save(any(AuthLoginChallenge.class))) .thenAnswer(invocation -> invocation.getArgument(0)); diff --git a/src/lib/api/client.js b/src/lib/api/client.js index 2ac8c02..9ff3f6d 100644 --- a/src/lib/api/client.js +++ b/src/lib/api/client.js @@ -3682,7 +3682,8 @@ export const setupAPI = { /** * Returns current setup state: setupComplete, hasOrganizationInfo, - * hasConnections, hasLlmConfig. Public endpoint — no auth required. + * hasConnections, hasLlmConfig, googleEnabled, passwordLoginEnabled. + * Public endpoint — no auth required. */ getStatus: async () => { const response = await apiClient.get("/api/setup/status"); diff --git a/src/pages/Login.jsx b/src/pages/Login.jsx index 308ec5f..b8929e3 100644 --- a/src/pages/Login.jsx +++ b/src/pages/Login.jsx @@ -98,8 +98,15 @@ export default function Login() { } + // Default to showing the password form: setupStatus is null on first paint and + // while the request is in flight, and an install that never set the flag gets + // `undefined`. Both must render the form, or a slow/failed status call would + // strand everyone on a login page with no way in. + const passwordLoginEnabled = setupStatus?.passwordLoginEnabled !== false + const renderLoginStep = () => ( <> + {passwordLoginEnabled && (