Streamline login for single provider instances (#2720)

[stuzart]

Closes #2720

Two dead ends reported on an instance that routes all users through a single OIDC provider (Keycloak).

Register button

The Register link stayed visible when registration_disabled was set, leading only to a page saying registration is not available. It is now hidden in the navbar, on the home page and in the login panel footer. The explanation remains on /signup for anyone arriving there directly.

While in there: registration_disabled was only ever a view level check, so POST /users still created accounts. That is now enforced in the controller.

Interim login page

With one provider configured and the standard login turned off, clicking "Log in" showed a page containing a single "Sign in with Keycloak" button. When enabled, the user is now sent straight to the provider instead.

This is behind a new admin setting, omniauth_skip_login_page, off by default, so nothing changes for existing instances until an administrator opts in. It only applies when a single provider is the only way in and that provider redirects out to an external service - LDAP and the standard login collect credentials in SEEK, so they still need the page. Registering is never skipped, as the terms and conditions have to be accepted first.

/auth/:provider is POST only, so this is a self submitting form rather than a redirect, with the button left visible as a fallback where JavaScript is unavailable. A requested strategy or a flash error suppresses it, so a failed login lands on the login page rather than bouncing straight back to the provider.

Also

The login panel footer drops the password reset link when the standard login is not shown, as there is no SEEK password to reset.

Notes for review

• omniauth_skip_login_page is a new setting and will want a line in the release notes. Sören will need to enable it to get the behaviour from the issue.
• show_standard_password_login? is renamed to show_password_login? so every strategy answers to show_<strategy>_login? and the lookup can dispatch on the name alone.

[Copilot]

Pull request overview

This PR improves UX and correctness for instances that route authentication through a single external OmniAuth/OIDC provider by (1) hiding registration entry points when registration is disabled and (2) optionally skipping the interim “single provider” login page via a new admin setting.

Changes:

• Hide “Register” links/buttons across the navbar, home page, and login panel footer when registration_disabled is enabled; enforce the same rule server-side by blocking POST /users.
• Add omniauth_skip_login_page (default: off) to auto-submit a POST to /auth/:provider when there is exactly one redirecting login provider available, while avoiding redirects on explicit strategy selection or failed login.
• Rename show_standard_password_login? to show_password_login? and expand test coverage for the new behavior.

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
test/functional/users_controller_test.rb	Adds coverage for registration-disabled enforcement and ensures registration page is not auto-skipped.
test/functional/sessions_controller_test.rb	Adds coverage for auto-skipping login page under a single redirecting provider and verifies suppression conditions.
test/functional/homes_controller_test.rb	Verifies home-page “Register” button is hidden when registration is disabled.
lib/seek/config_setting_attributes.yml	Registers new omniauth_skip_login_page configuration setting.
config/initializers/seek_configuration.rb	Defines default value for omniauth_skip_login_page (false).
app/views/users/new.html.erb	Updates view logic to use show_password_login?.
app/views/sessions/new.html.erb	Renders new auto-login partial when auto_login_strategy applies.
app/views/sessions/_auto_login.html.erb	New auto-submitting POST form to initiate OmniAuth login while keeping a visible fallback button.
app/views/layouts/navbar/_navbar.html.erb	Hides navbar “Register” link when registration is disabled.
app/views/homes/_home_features.html.erb	Hides home “Register” button when registration is disabled.
app/views/gadgets/_sign_in.html.erb	Uses show_password_login? and conditionally hides footer links when registration/password reset aren’t applicable.
app/views/admin/_omniauth.html.erb	Adds admin checkbox setting for omniauth_skip_login_page.
app/helpers/sessions_helper.rb	Implements strategy selection helpers and the auto_login_strategy decision logic; renames show_* helper.
app/controllers/users_controller.rb	Enforces registration_disabled at controller level for user creation.
app/controllers/admin_controller.rb	Persists omniauth_skip_login_page from the admin settings form.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.