You can disable password-based sign-in in a Turnkey application when your users must authenticate through an external social or OpenID Connect login; this page is for Turnkey administrators configuring that experience.
What HidePasswordLogin does
Set HidePasswordLogin to True to remove the password-login option from the Turnkey account user interface.
When the setting is enabled:
- The Register link is not shown.
- Social login icons are added to the main menu so users can start external authentication directly.
Use this setting only when the external login option that your users need is configured and available. If you hide password login without a usable external sign-in path, users cannot use the normal local-account password flow.
Configure the setting
TurnkeySettings.xml is stored in the Turnkey application's App_Data folder. Add or change the setting as follows:
<HidePasswordLogin>True</HidePasswordLogin>
- Decide where the setting belongs.
- If your application is managed through the Portal, remember that the Portal recreates
TurnkeySettings.xmlwhen you selectSendSettingsAndRestart. - For a setting that must not be overwritten when TurnkeyCore is refreshed, place it in
TurnkeySettingsOverride.xml. This file is read afterTurnkeySettings.xml. - For a local or experimental setting that the Portal does not manage, you can use
TurnkeySettingsExtra.xml. This file is read beforeTurnkeySettings.xml.
- If your application is managed through the Portal, remember that the Portal recreates
- Set
HidePasswordLogintoTruein the selected settings file. - Restart or apply settings using the process appropriate for your installation.
- Open the application while signed out and confirm that Register and password sign-in are absent and that the external login icons are available in the main menu.
The default shown in TurnkeySettings is False. Set it back to False to restore the password-login user interface.
Example: organization-managed sign-in
An organization configures an OpenID Connect identity provider (IDP) and wants every user to enter through that provider rather than create a local password account. The administrator sets:
<HidePasswordLogin>True</HidePasswordLogin>
<OpenIDConnectScope>openid profile email</OpenIDConnectScope>
In this example, email is included because the IDP makes it available and the application needs the email claim during external-account registration. The normal scope is openid profile when no custom OpenIDConnectScope value is supplied.
Related single sign-on settings
The following settings work with external authentication. Configure only the values that match your identity-provider and account-registration requirements.
| Setting | Purpose | Example decision |
|---|---|---|
HidePasswordLogin
|
Hides password login and the Register link; adds social login icons to the main menu. | Set to True when all users must use external sign-in.
|
AllowUserToChooseSocialLoginEmail
|
Controls whether, during first external login and local-account registration, the user can edit the email address or the address is taken from the external user ID. | Allow editing when users may need to correct the email supplied during registration; otherwise take the identity from the external provider. |
SkipExternalAccountConfirmationScreen
|
Skips the screen that confirms the local account during the first external login. | Enable when your registration flow does not require the user to review that confirmation step. |
OpenIDConnectScope
|
Sets the requested OpenID Connect scopes. Without a supplied value, Turnkey uses openid profile.
|
Add email when the IDP provides it and your external-login flow requires it.
|
HidePasswordLogin and HideExternalLogin are different
HidePasswordLogin controls the local password-login and registration experience. It does not mean that the external-login navigation buttons are hidden.
If you provide your own login page and do not want Turnkey's default external authentication buttons in the navigation bar, configure HideExternalLogin instead or in addition. See HowTos:Hide External Login Buttons.
Account and recovery considerations
Hiding password login changes the end-user sign-in interface; it does not replace your administrative access and recovery plan. Maintain a tested administrator-access procedure for your MDrivenServer before enforcing external-only authentication. For a self-managed server, see Documentation:MDrivenServer, Lost password or locked out.
If you retain local password accounts elsewhere in the application, password recovery is a separate feature. Turnkey has no built-in password-reset functionality; use Documentation:Password Reset Package when you need an adaptable reset-password flow.