From 68b4a0c948d94de4d1002e0f16efceec8501998b Mon Sep 17 00:00:00 2001
From: Uwe Winter <uwwint@gmail.com>
Date: Fri, 9 May 2025 10:03:31 +1000
Subject: [PATCH] Add Config opion disable_local_accounts

---
 doc/source/admin/galaxy_options.rst         | 12 ++++++++++++
 lib/galaxy/config/sample/galaxy.yml.sample  |  5 +++++
 lib/galaxy/config/schemas/config_schema.yml |  8 ++++++++
 lib/galaxy/managers/configuration.py        |  1 +
 4 files changed, 26 insertions(+)

diff --git a/doc/source/admin/galaxy_options.rst b/doc/source/admin/galaxy_options.rst
index 0952c1b6d22..ca286ec5bf1 100644
--- a/doc/source/admin/galaxy_options.rst
+++ b/doc/source/admin/galaxy_options.rst
@@ -3839,6 +3839,18 @@
 :Type: bool
 
 
+~~~~~~~~~~~~~~~~~~~~~~~~~~
+``disable_local_accounts``
+~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+:Description:
+    Disable local accounts. If this option is set to true, at least
+    one OIDC provider needs  to be configured and will serve as the
+    account provider.
+:Default: ``false``
+:Type: bool
+
+
 ~~~~~~~~~~~~~~~~~~~~~~~
 ``allow_user_deletion``
 ~~~~~~~~~~~~~~~~~~~~~~~
diff --git a/lib/galaxy/config/sample/galaxy.yml.sample b/lib/galaxy/config/sample/galaxy.yml.sample
index 3b4d1a48571..a39e2a3f2c0 100644
--- a/lib/galaxy/config/sample/galaxy.yml.sample
+++ b/lib/galaxy/config/sample/galaxy.yml.sample
@@ -2119,6 +2119,11 @@ galaxy:
   # will have to be created by an admin).
   #allow_user_creation: true
 
+  # Disable local accounts. If this option is set to true, at least one
+  # OIDC provider needs  to be configured and will serve as the account
+  # provider.
+  #disable_local_accounts: false
+
   # Allow administrators to delete accounts.
   #allow_user_deletion: false
 
diff --git a/lib/galaxy/config/schemas/config_schema.yml b/lib/galaxy/config/schemas/config_schema.yml
index 050b6645a7e..3e76dabb8bf 100644
--- a/lib/galaxy/config/schemas/config_schema.yml
+++ b/lib/galaxy/config/schemas/config_schema.yml
@@ -2830,6 +2830,14 @@ mapping:
           Allow unregistered users to create new accounts (otherwise, they will have to
           be created by an admin).
 
+      disable_local_accounts:
+        type: bool
+        default: false
+        required: true
+        desc: |
+          Disable local accounts. If this option is set to true, at least one OIDC provider needs 
+          to be configured and will serve as the account provider. 
+
       allow_user_deletion:
         type: bool
         default: false
diff --git a/lib/galaxy/managers/configuration.py b/lib/galaxy/managers/configuration.py
index e6ac062fd90..5729f7227de 100644
--- a/lib/galaxy/managers/configuration.py
+++ b/lib/galaxy/managers/configuration.py
@@ -144,6 +144,7 @@ class ConfigSerializer(base.ModelSerializer):
             "topk_recommendations": _use_config,
             "allow_user_impersonation": _use_config,
             "allow_user_creation": _defaults_to(False),  # schema default is True
+            "disable_local_accounts": _defaults_to(False),  # schema default is False
             "use_remote_user": _defaults_to(None),  # schema default is False; or config.single_user
             "single_user": _config_is_truthy,
             "enable_oidc": _use_config,