Document how to toggle user auto creation

hmpf · Nov 15, 2023 · 5ee318a · 5ee318a
1 parent 896ea08
commit 5ee318a
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 0 deletions.
diff --git a/doc/howto/mod_auth_openidc_feide.rst b/doc/howto/mod_auth_openidc_feide.rst
@@ -147,11 +147,17 @@ NAV configuration
     varname = REMOTE_USER
     logout-url = /oidc/?logout=
     workaround = feide-oidc
+    autocreate = off
 
 "oidc" in the ``logout-url`` points to the same place as the
 ``<Location /oidc>``-block in the apache configuration and the redirect URI in
 the Feide dashboard.
 
+By toggling autocreate to "on", users are automatically created on first login
+via OIDC, This is probably not what you want, which is why the  default is
+"off". With it "off" it is necessary to pre-create the users in order to allow
+login.
+
 Gotchas
 =======
 

diff --git a/doc/reference/web_authentication.rst b/doc/reference/web_authentication.rst
@@ -21,6 +21,17 @@ Since the password is controlled from a system externally to NAV, the user does
 not have access to change the password from inside NAV. If an account is set to
 invalid in NAV, the user will not be logged in, even if the header is set.
 
+Creating users on first login
+-----------------------------
+
+Earlier versions of this functionality created users on first login. That is no
+longer the case. To enable the previous behaviour, set ``autocreate = on`` in
+the ``[remote-user]`` section in the config-file.
+
+With the default, which is ``off``, it is necessary to pre-create users for
+them to be able to log in. This can be done from the command line with
+``navuser``, or via the web interface.
+
 Workarounds for "strange" `REMOTE_USER` values
 ----------------------------------------------