coder · kylecarbs · Jan 31, 2023 · Nov 16, 2022 · Nov 16, 2022 · Nov 16, 2022
diff --git a/cli/deployment/config.go b/cli/deployment/config.go
@@ -157,6 +157,11 @@ func newConfig() *codersdk.DeploymentConfig {
 			Flag:   "postgres-url",
 			Secret: true,
 		},
+		PasswordAuthHidden: &codersdk.DeploymentConfigField[bool]{
+			Name:  "Flag to hide password auth",
+			Usage: "When this flag is set to true, the user/password form in the UI will be hidden",
+			Flag:  "password-auth-hidden",
+		},
 		OAuth2: &codersdk.OAuth2Config{
 			Github: &codersdk.OAuth2GithubConfig{
 				ClientID: &codersdk.DeploymentConfigField[string]{
@@ -231,6 +236,16 @@ func newConfig() *codersdk.DeploymentConfig {
 				Flag:    "oidc-scopes",
 				Default: []string{oidc.ScopeOpenID, "profile", "email"},
 			},
+			SignInText: &codersdk.DeploymentConfigField[string]{
+				Name:  "OpenID Connect sign in text",
+				Usage: "The text to show on the OpenID Connect sign in button",
+				Flag:  "oidc-sign-in-text",
+			},
+			IconURL: &codersdk.DeploymentConfigField[string]{
+				Name:  "OpenID connect icon URL",
+				Usage: "URL pointing to the icon to use on the OepnID Connect login button",
+				Flag:  "oidc-icon-url",
+			},
 		},
 
 		Telemetry: &codersdk.TelemetryConfig{

diff --git a/cli/server.go b/cli/server.go
@@ -370,6 +370,8 @@ func Server(vip *viper.Viper, newAPI func(context.Context, *coderd.Options) (*co
 				options.TLSCertificates = tlsConfig.Certificates
 			}
 
+			options.PasswordAuthHidden = cfg.PasswordAuthHidden.Value
+
 			if cfg.OAuth2.Github.ClientSecret.Value != "" {
 				options.GithubOAuth2Config, err = configureGithubOAuth2(accessURLParsed,
 					cfg.OAuth2.Github.ClientID.Value,
@@ -419,6 +421,8 @@ func Server(vip *viper.Viper, newAPI func(context.Context, *coderd.Options) (*co
 					}),
 					EmailDomain:  cfg.OIDC.EmailDomain.Value,
 					AllowSignups: cfg.OIDC.AllowSignups.Value,
+					SignInText:   cfg.OIDC.SignInText.Value,
+					IconURL:      cfg.OIDC.IconURL.Value,
 				}
 			}
 

diff --git a/cli/testdata/coder_server_--help.golden b/cli/testdata/coder_server_--help.golden
@@ -98,12 +98,22 @@ Flags:
       --oidc-email-domain string                     Email domain that clients logging in with
                                                      OIDC must match.
                                                      Consumes $CODER_OIDC_EMAIL_DOMAIN
+      --oidc-icon-url string                         URL pointing to the icon to use on the
+                                                     OepnID Connect login button
+                                                     Consumes $CODER_OIDC_ICON_URL
       --oidc-issuer-url string                       Issuer URL to use for Login with OIDC.
                                                      Consumes $CODER_OIDC_ISSUER_URL
       --oidc-scopes strings                          Scopes to grant when authenticating with
                                                      OIDC.
                                                      Consumes $CODER_OIDC_SCOPES (default
                                                      [openid,profile,email])
+      --oidc-sign-in-text string                     The text to show on the OpenID Connect
+                                                     sign in button
+                                                     Consumes $CODER_OIDC_SIGN_IN_TEXT
+      --password-auth-hidden                         When this flag is set to true, the
+                                                     user/password form in the UI will be
+                                                     hidden
+                                                     Consumes $CODER_PASSWORD_AUTH_HIDDEN
       --postgres-url string                          URL of a PostgreSQL database. If empty,
                                                      PostgreSQL binaries will be downloaded
                                                      from Maven

diff --git a/coderd/coderd.go b/coderd/coderd.go
@@ -76,6 +76,7 @@ type Options struct {
 	Authorizer           rbac.Authorizer
 	AzureCertificates    x509.VerifyOptions
 	GoogleTokenValidator *idtoken.Validator
+	PasswordAuthHidden   bool
 	GithubOAuth2Config   *GithubOAuth2Config
 	OIDCConfig           *OIDCConfig
 	PrometheusRegistry   *prometheus.Registry

diff --git a/coderd/userauth.go b/coderd/userauth.go
@@ -44,10 +44,27 @@ type GithubOAuth2Config struct {
 }
 
 func (api *API) userAuthMethods(rw http.ResponseWriter, r *http.Request) {
+	var signInText string
+	var iconURL string
+
+	if api.OIDCConfig != nil {
+		signInText = api.OIDCConfig.SignInText
+	}
+	if api.OIDCConfig != nil {
+		iconURL = api.OIDCConfig.IconURL
+	}
+
 	httpapi.Write(r.Context(), rw, http.StatusOK, codersdk.AuthMethods{
-		Password: true,
-		Github:   api.GithubOAuth2Config != nil,
-		OIDC:     api.OIDCConfig != nil,
+		Password: codersdk.PasswordMethod{
+			AuthMethod: codersdk.AuthMethod{Enabled: true},
+			Hidden:     api.PasswordAuthHidden,
+		},
+		Github: codersdk.AuthMethod{Enabled: api.GithubOAuth2Config != nil},
+		OIDC: codersdk.OIDCMethod{
+			AuthMethod: codersdk.AuthMethod{Enabled: api.OIDCConfig != nil},
+			SignInText: signInText,
+			IconURL:    iconURL,
+		},
 	})
 }
 
@@ -195,6 +212,8 @@ type OIDCConfig struct {
 	// EmailDomain is the domain to enforce when a user authenticates.
 	EmailDomain  string
 	AllowSignups bool
+	SignInText   string
+	IconURL      string
 }
 
 func (api *API) userOIDC(rw http.ResponseWriter, r *http.Request) {

diff --git a/coderd/userauth_test.go b/coderd/userauth_test.go
@@ -77,8 +77,8 @@ func TestUserAuthMethods(t *testing.T) {
 
 		methods, err := client.AuthMethods(ctx)
 		require.NoError(t, err)
-		require.True(t, methods.Password)
-		require.False(t, methods.Github)
+		require.True(t, methods.Password.Enabled)
+		require.False(t, methods.Github.Enabled)
 	})
 	t.Run("Github", func(t *testing.T) {
 		t.Parallel()
@@ -91,8 +91,8 @@ func TestUserAuthMethods(t *testing.T) {
 
 		methods, err := client.AuthMethods(ctx)
 		require.NoError(t, err)
-		require.True(t, methods.Password)
-		require.True(t, methods.Github)
+		require.True(t, methods.Password.Enabled)
+		require.True(t, methods.Github.Enabled)
 	})
 }
 

diff --git a/codersdk/deploymentconfig.go b/codersdk/deploymentconfig.go
@@ -24,6 +24,7 @@ type DeploymentConfig struct {
 	CacheDirectory              *DeploymentConfigField[string]          `json:"cache_directory" typescript:",notnull"`
 	InMemoryDatabase            *DeploymentConfigField[bool]            `json:"in_memory_database" typescript:",notnull"`
 	PostgresURL                 *DeploymentConfigField[string]          `json:"pg_connection_url" typescript:",notnull"`
+	PasswordAuthHidden          *DeploymentConfigField[bool]            `json:"password_auth_hidden" typescript:",notnull"`
 	OAuth2                      *OAuth2Config                           `json:"oauth2" typescript:",notnull"`
 	OIDC                        *OIDCConfig                             `json:"oidc" typescript:",notnull"`
 	Telemetry                   *TelemetryConfig                        `json:"telemetry" typescript:",notnull"`
@@ -92,6 +93,8 @@ type OIDCConfig struct {
 	EmailDomain  *DeploymentConfigField[string]   `json:"email_domain" typescript:",notnull"`
 	IssuerURL    *DeploymentConfigField[string]   `json:"issuer_url" typescript:",notnull"`
 	Scopes       *DeploymentConfigField[[]string] `json:"scopes" typescript:",notnull"`
+	SignInText   *DeploymentConfigField[string]   `json:"sign_in_text" typescript:",notnull"`
+	IconURL      *DeploymentConfigField[string]   `json:"icon_url" typescript:",notnull"`
 }
 
 type TelemetryConfig struct {

diff --git a/codersdk/users.go b/codersdk/users.go
@@ -105,11 +105,26 @@ type CreateOrganizationRequest struct {
 	Name string `json:"name" validate:"required,username"`
 }
 
-// AuthMethods contains whether authentication types are enabled or not.
+// AuthMethods contains authentication method information like whether they are enabled or not or hidden or not, etc.
 type AuthMethods struct {
-	Password bool `json:"password"`
-	Github   bool `json:"github"`
-	OIDC     bool `json:"oidc"`
+	Password PasswordMethod `json:"password"`
+	Github   AuthMethod     `json:"github"`
+	OIDC     OIDCMethod     `json:"oidc"`
+}
+
+type AuthMethod struct {
+	Enabled bool `json:"enabled"`
+}
+
+type PasswordMethod struct {
+	AuthMethod
+	Hidden bool `json:"hidden"`
+}
+
+type OIDCMethod struct {
+	AuthMethod
+	SignInText string `json:"signInText"`
+	IconURL    string `json:"iconUrl"`
 }
 
 // HasFirstUser returns whether the first user has been created.

diff --git a/docs/admin/auth.md b/docs/admin/auth.md
@@ -4,6 +4,10 @@ By default, Coder is accessible via password authentication.
 
 The following steps explain how to set up GitHub OAuth or OpenID Connect.
 
+If after configuring another authentication method you'd like to hide password authentication, you can configure that like so:
+```console
+CODER_PASSWORD_AUTH_HIDDEN=true
+```
 ## GitHub
 
 ### Step 1: Configure the OAuth application in GitHub
@@ -81,6 +85,12 @@ CODER_TLS_CLIENT_CERT_FILE=/path/to/cert.pem
 CODER_TLS_CLIENT_KEY_FILE=/path/to/key.pem
 ```
 
+If you'd like to change the OpenID Connect button text and/or icon, you can configure them like so:
+```console
+CODER_OIDC_SIGN_IN_TEXT="Sign in with Gitea"
+CODER_OIDC_ICON_URL=https://gitea.io/images/gitea.png
+```
+
 ## SCIM (enterprise)
 
 Coder supports user provisioning and deprovisioning via SCIM 2.0 with header

diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
@@ -90,11 +90,16 @@ export interface AuditLogsRequest extends Pagination {
   readonly q?: string
 }
 
+// From codersdk/users.go
+export interface AuthMethod {
+  readonly enabled: boolean
+}
+
 // From codersdk/users.go
 export interface AuthMethods {
-  readonly password: boolean
-  readonly github: boolean
-  readonly oidc: boolean
+  readonly password: PasswordMethod
+  readonly github: AuthMethod
+  readonly oidc: OIDCMethod
 }
 
 // From codersdk/authorization.go
@@ -289,6 +294,7 @@ export interface DeploymentConfig {
   readonly cache_directory: DeploymentConfigField<string>
   readonly in_memory_database: DeploymentConfigField<boolean>
   readonly pg_connection_url: DeploymentConfigField<string>
+  readonly password_auth_hidden: DeploymentConfigField<boolean>
   readonly oauth2: OAuth2Config
   readonly oidc: OIDCConfig
   readonly telemetry: TelemetryConfig
@@ -446,6 +452,14 @@ export interface OIDCConfig {
   readonly email_domain: DeploymentConfigField<string>
   readonly issuer_url: DeploymentConfigField<string>
   readonly scopes: DeploymentConfigField<string[]>
+  readonly sign_in_text: DeploymentConfigField<string>
+  readonly icon_url: DeploymentConfigField<string>
+}
+
+// From codersdk/users.go
+export interface OIDCMethod extends AuthMethod {
+  readonly signInText: string
+  readonly iconUrl: string
 }
 
 // From codersdk/organizations.go
@@ -505,6 +519,11 @@ export interface ParameterSchema {
   readonly validation_contains?: string[]
 }
 
+// From codersdk/users.go
+export interface PasswordMethod extends AuthMethod {
+  readonly hidden: boolean
+}
+
 // From codersdk/groups.go
 export interface PatchGroupRequest {
   readonly add_users: string[]

diff --git a/site/src/components/SignInForm/SignInForm.stories.tsx b/site/src/components/SignInForm/SignInForm.stories.tsx
@@ -29,8 +29,9 @@ Loading.args = {
   ...SignedOut.args,
   isLoading: true,
   authMethods: {
-    github: true,
-    password: true,
+    password: { enabled: true, hidden: false },
+    github: { enabled: true },
+    oidc: { enabled: false, signInText: "", iconUrl: "" },
   },
 }
 
@@ -99,28 +100,28 @@ export const WithGithub = Template.bind({})
 WithGithub.args = {
   ...SignedOut.args,
   authMethods: {
-    password: true,
-    github: true,
-    oidc: false,
+    password: { enabled: true, hidden: false },
+    github: { enabled: true },
+    oidc: { enabled: false, signInText: "", iconUrl: "" },
   },
 }
 
 export const WithOIDC = Template.bind({})
 WithOIDC.args = {
   ...SignedOut.args,
   authMethods: {
-    password: true,
-    github: false,
-    oidc: true,
+    password: { enabled: true, hidden: false },
+    github: { enabled: false },
+    oidc: { enabled: true, signInText: "", iconUrl: "" },
   },
 }
 
 export const WithGithubAndOIDC = Template.bind({})
 WithGithubAndOIDC.args = {
   ...SignedOut.args,
   authMethods: {
-    password: true,
-    github: true,
-    oidc: true,
+    password: { enabled: true, hidden: false },
+    github: { enabled: true },
+    oidc: { enabled: true, signInText: "", iconUrl: "" },
   },
 }