feat(jwt): Enable using User Properties as custom claims (#3571)

controllers/auth.go

@@ -70,6 +70,16 @@ func (c *ApiController) HandleLoggedIn(application *object.Application, user *ob
 		return
 	}
 
+	if application.DisableSignin {
+		c.ResponseError(fmt.Sprintf(c.T("auth:The application: %s has disabled users to signin"), application.Name))
+		return
+	}
+
+	if application.OrganizationObj != nil && application.OrganizationObj.DisableSignin {
+		c.ResponseError(fmt.Sprintf(c.T("auth:The organization: %s has disabled users to signin"), application.Organization))
+		return
+	}
+
 	allowed, err := object.CheckLoginPermission(userId, application)
 	if err != nil {
 		c.ResponseError(err.Error(), nil)

i18n/locales/ar/data.json

@@ -16,12 +16,14 @@
     "The account for provider: %s and username: %s (%s) does not exist and is not allowed to sign up as new account, please contact your IT support": "الحساب الخاص بالمزود: %s واسم المستخدم: %s (%s) غير موجود ولا يُسمح بالتسجيل كحساب جديد، يرجى الاتصال بدعم تكنولوجيا المعلومات",
     "The account for provider: %s and username: %s (%s) is already linked to another account: %s (%s)": "الحساب الخاص بالمزود: %s واسم المستخدم: %s (%s) مرتبط بالفعل بحساب آخر: %s (%s)",
     "The application: %s does not exist": "التطبيق: %s غير موجود",
+    "The application: %s has disabled users to signin": "The application: %s has disabled users to signin",
     "The login method: login with LDAP is not enabled for the application": "طريقة تسجيل الدخول: تسجيل الدخول باستخدام LDAP غير مفعّلة لهذا التطبيق",
     "The login method: login with SMS is not enabled for the application": "طريقة تسجيل الدخول: تسجيل الدخول باستخدام الرسائل النصية غير مفعّلة لهذا التطبيق",
     "The login method: login with email is not enabled for the application": "طريقة تسجيل الدخول: تسجيل الدخول باستخدام البريد الإلكتروني غير مفعّلة لهذا التطبيق",
     "The login method: login with face is not enabled for the application": "طريقة تسجيل الدخول: تسجيل الدخول باستخدام الوجه غير مفعّلة لهذا التطبيق",
     "The login method: login with password is not enabled for the application": "طريقة تسجيل الدخول: تسجيل الدخول باستخدام كلمة المرور غير مفعّلة لهذا التطبيق",
     "The organization: %s does not exist": "المنظمة: %s غير موجودة",
+    "The organization: %s has disabled users to signin": "The organization: %s has disabled users to signin",
     "The provider: %s does not exist": "المزود: %s غير موجود",
     "The provider: %s is not enabled for the application": "المزود: %s غير مفعّل لهذا التطبيق",
     "Unauthorized operation": "عملية غير مصرح بها",

i18n/locales/cs/data.json

@@ -16,12 +16,14 @@
     "The account for provider: %s and username: %s (%s) does not exist and is not allowed to sign up as new account, please contact your IT support": "Účet pro poskytovatele: %s a uživatelské jméno: %s (%s) neexistuje a není povoleno se registrovat jako nový účet, prosím kontaktujte svou IT podporu",
     "The account for provider: %s and username: %s (%s) is already linked to another account: %s (%s)": "Účet pro poskytovatele: %s a uživatelské jméno: %s (%s) je již propojen s jiným účtem: %s (%s)",
     "The application: %s does not exist": "Aplikace: %s neexistuje",
+    "The application: %s has disabled users to signin": "The application: %s has disabled users to signin",
     "The login method: login with LDAP is not enabled for the application": "Přihlašovací metoda: přihlášení pomocí LDAP není pro aplikaci povolena",
     "The login method: login with SMS is not enabled for the application": "Přihlašovací metoda: přihlášení pomocí SMS není pro aplikaci povolena",
     "The login method: login with email is not enabled for the application": "Přihlašovací metoda: přihlášení pomocí e-mailu není pro aplikaci povolena",
     "The login method: login with face is not enabled for the application": "Přihlašovací metoda: přihlášení pomocí obličeje není pro aplikaci povolena",
     "The login method: login with password is not enabled for the application": "Metoda přihlášení: přihlášení pomocí hesla není pro aplikaci povolena",
     "The organization: %s does not exist": "Organizace: %s neexistuje",
+    "The organization: %s has disabled users to signin": "The organization: %s has disabled users to signin",
     "The provider: %s does not exist": "Poskytovatel: %s neexistuje",
     "The provider: %s is not enabled for the application": "Poskytovatel: %s není pro aplikaci povolen",
     "Unauthorized operation": "Neoprávněná operace",

i18n/locales/de/data.json

@@ -16,12 +16,14 @@
     "The account for provider: %s and username: %s (%s) does not exist and is not allowed to sign up as new account, please contact your IT support": "Das Konto für den Anbieter %s und Benutzernamen %s (%s) existiert nicht und es ist nicht erlaubt, ein neues Konto anzumelden. Bitte wenden Sie sich an Ihren IT-Support",
     "The account for provider: %s and username: %s (%s) is already linked to another account: %s (%s)": "Das Konto für den Anbieter %s und Benutzernamen %s (%s) ist bereits mit einem anderen Konto verknüpft: %s (%s)",
     "The application: %s does not exist": "Die Anwendung: %s existiert nicht",
+    "The application: %s has disabled users to signin": "The application: %s has disabled users to signin",
     "The login method: login with LDAP is not enabled for the application": "Die Anmeldemethode: Anmeldung mit LDAP ist für die Anwendung nicht aktiviert",
     "The login method: login with SMS is not enabled for the application": "Die Anmeldemethode: Anmeldung per SMS ist für die Anwendung nicht aktiviert",
     "The login method: login with email is not enabled for the application": "Die Anmeldemethode: Anmeldung per E-Mail ist für die Anwendung nicht aktiviert",
     "The login method: login with face is not enabled for the application": "Die Anmeldemethode: Anmeldung per Gesicht ist für die Anwendung nicht aktiviert",
     "The login method: login with password is not enabled for the application": "Die Anmeldeart \"Anmeldung mit Passwort\" ist für die Anwendung nicht aktiviert",
     "The organization: %s does not exist": "Die Organisation: %s existiert nicht",
+    "The organization: %s has disabled users to signin": "The organization: %s has disabled users to signin",
     "The provider: %s does not exist": "Der Anbieter: %s existiert nicht",
     "The provider: %s is not enabled for the application": "Der Anbieter: %s ist nicht für die Anwendung aktiviert",
     "Unauthorized operation": "Nicht autorisierte Operation",

i18n/locales/en/data.json

@@ -16,12 +16,14 @@
     "The account for provider: %s and username: %s (%s) does not exist and is not allowed to sign up as new account, please contact your IT support": "The account for provider: %s and username: %s (%s) does not exist and is not allowed to sign up as new account, please contact your IT support",
     "The account for provider: %s and username: %s (%s) is already linked to another account: %s (%s)": "The account for provider: %s and username: %s (%s) is already linked to another account: %s (%s)",
     "The application: %s does not exist": "The application: %s does not exist",
+    "The application: %s has disabled users to signin": "The application: %s has disabled users to signin",
     "The login method: login with LDAP is not enabled for the application": "The login method: login with LDAP is not enabled for the application",
     "The login method: login with SMS is not enabled for the application": "The login method: login with SMS is not enabled for the application",
     "The login method: login with email is not enabled for the application": "The login method: login with email is not enabled for the application",
     "The login method: login with face is not enabled for the application": "The login method: login with face is not enabled for the application",
     "The login method: login with password is not enabled for the application": "The login method: login with password is not enabled for the application",
     "The organization: %s does not exist": "The organization: %s does not exist",
+    "The organization: %s has disabled users to signin": "The organization: %s has disabled users to signin",
     "The provider: %s does not exist": "The provider: %s does not exist",
     "The provider: %s is not enabled for the application": "The provider: %s is not enabled for the application",
     "Unauthorized operation": "Unauthorized operation",

i18n/locales/es/data.json

@@ -16,12 +16,14 @@
     "The account for provider: %s and username: %s (%s) does not exist and is not allowed to sign up as new account, please contact your IT support": "La cuenta para el proveedor: %s y el nombre de usuario: %s (%s) no existe y no se permite registrarse como una nueva cuenta, por favor contacte a su soporte de TI",
     "The account for provider: %s and username: %s (%s) is already linked to another account: %s (%s)": "La cuenta para proveedor: %s y nombre de usuario: %s (%s) ya está vinculada a otra cuenta: %s (%s)",
     "The application: %s does not exist": "La aplicación: %s no existe",
+    "The application: %s has disabled users to signin": "The application: %s has disabled users to signin",
     "The login method: login with LDAP is not enabled for the application": "El método de inicio de sesión: inicio de sesión con LDAP no está habilitado para la aplicación",
     "The login method: login with SMS is not enabled for the application": "El método de inicio de sesión: inicio de sesión con SMS no está habilitado para la aplicación",
     "The login method: login with email is not enabled for the application": "El método de inicio de sesión: inicio de sesión con correo electrónico no está habilitado para la aplicación",
     "The login method: login with face is not enabled for the application": "El método de inicio de sesión: inicio de sesión con reconocimiento facial no está habilitado para la aplicación",
     "The login method: login with password is not enabled for the application": "El método de inicio de sesión: inicio de sesión con contraseña no está habilitado para la aplicación",
     "The organization: %s does not exist": "La organización: %s no existe",
+    "The organization: %s has disabled users to signin": "The organization: %s has disabled users to signin",
     "The provider: %s does not exist": "El proveedor: %s no existe",
     "The provider: %s is not enabled for the application": "El proveedor: %s no está habilitado para la aplicación",
     "Unauthorized operation": "Operación no autorizada",

i18n/locales/fa/data.json

@@ -16,12 +16,14 @@
     "The account for provider: %s and username: %s (%s) does not exist and is not allowed to sign up as new account, please contact your IT support": "حساب برای ارائه‌دهنده: %s و نام کاربری: %s (%s) وجود ندارد و مجاز به ثبت‌نام به‌عنوان حساب جدید نیست، لطفاً با پشتیبانی IT خود تماس بگیرید",
     "The account for provider: %s and username: %s (%s) is already linked to another account: %s (%s)": "حساب برای ارائه‌دهنده: %s و نام کاربری: %s (%s) در حال حاضر به حساب دیگری مرتبط است: %s (%s)",
     "The application: %s does not exist": "برنامه: %s وجود ندارد",
+    "The application: %s has disabled users to signin": "The application: %s has disabled users to signin",
     "The login method: login with LDAP is not enabled for the application": "روش ورود: ورود با LDAP برای برنامه فعال نیست",
     "The login method: login with SMS is not enabled for the application": "روش ورود: ورود با پیامک برای برنامه فعال نیست",
     "The login method: login with email is not enabled for the application": "روش ورود: ورود با ایمیل برای برنامه فعال نیست",
     "The login method: login with face is not enabled for the application": "روش ورود: ورود با چهره برای برنامه فعال نیست",
     "The login method: login with password is not enabled for the application": "روش ورود: ورود با رمز عبور برای برنامه فعال نیست",
     "The organization: %s does not exist": "سازمان: %s وجود ندارد",
+    "The organization: %s has disabled users to signin": "The organization: %s has disabled users to signin",
     "The provider: %s does not exist": "ارائه‌کننده: %s وجود ندارد",
     "The provider: %s is not enabled for the application": "ارائه‌دهنده: %s برای برنامه فعال نیست",
     "Unauthorized operation": "عملیات غیرمجاز",

i18n/locales/fi/data.json

@@ -16,12 +16,14 @@
     "The account for provider: %s and username: %s (%s) does not exist and is not allowed to sign up as new account, please contact your IT support": "Tiliä providerille: %s ja käyttäjälle: %s (%s) ei ole olemassa, eikä sitä voi rekisteröidä uutena tilinä, ota yhteyttä IT-tukeen",
     "The account for provider: %s and username: %s (%s) is already linked to another account: %s (%s)": "Tili providerille: %s ja käyttäjälle: %s (%s) on jo linkitetty toiseen tiliin: %s (%s)",
     "The application: %s does not exist": "Sovellus: %s ei ole olemassa",
+    "The application: %s has disabled users to signin": "The application: %s has disabled users to signin",
     "The login method: login with LDAP is not enabled for the application": "Kirjautumistapa: kirjautuminen LDAP:n kautta ei ole käytössä sovelluksessa",
     "The login method: login with SMS is not enabled for the application": "Kirjautumistapa: kirjautuminen SMS:n kautta ei ole käytössä sovelluksessa",
     "The login method: login with email is not enabled for the application": "Kirjautumistapa: kirjautuminen sähköpostin kautta ei ole käytössä sovelluksessa",
     "The login method: login with face is not enabled for the application": "Kirjautumistapa: kirjautuminen kasvotunnistuksella ei ole käytössä sovelluksessa",
     "The login method: login with password is not enabled for the application": "Kirjautumistapa: kirjautuminen salasanalla ei ole käytössä sovelluksessa",
     "The organization: %s does not exist": "Organisaatio: %s ei ole olemassa",
+    "The organization: %s has disabled users to signin": "The organization: %s has disabled users to signin",
     "The provider: %s does not exist": "Provider: %s ei ole olemassa",
     "The provider: %s is not enabled for the application": "Provider: %s ei ole käytössä sovelluksessa",
     "Unauthorized operation": "Luvaton toiminto",

i18n/locales/fr/data.json

@@ -16,12 +16,14 @@
     "The account for provider: %s and username: %s (%s) does not exist and is not allowed to sign up as new account, please contact your IT support": "Le compte pour le fournisseur : %s et le nom d'utilisateur : %s (%s) n'existe pas et n'est pas autorisé à s'inscrire comme nouveau compte, veuillez contacter votre support informatique",
     "The account for provider: %s and username: %s (%s) is already linked to another account: %s (%s)": "Le compte du fournisseur : %s et le nom d'utilisateur : %s (%s) sont déjà liés à un autre compte : %s (%s)",
     "The application: %s does not exist": "L'application : %s n'existe pas",
+    "The application: %s has disabled users to signin": "The application: %s has disabled users to signin",
     "The login method: login with LDAP is not enabled for the application": "La méthode de connexion : connexion LDAP n'est pas activée pour l'application",
     "The login method: login with SMS is not enabled for the application": "La méthode de connexion : connexion par SMS n'est pas activée pour l'application",
     "The login method: login with email is not enabled for the application": "La méthode de connexion : connexion par e-mail n'est pas activée pour l'application",
     "The login method: login with face is not enabled for the application": "La méthode de connexion : connexion par visage n'est pas activée pour l'application",
     "The login method: login with password is not enabled for the application": "La méthode de connexion : connexion avec mot de passe n'est pas activée pour l'application",
     "The organization: %s does not exist": "L'organisation : %s n'existe pas",
+    "The organization: %s has disabled users to signin": "The organization: %s has disabled users to signin",
     "The provider: %s does not exist": "Le fournisseur : %s n'existe pas",
     "The provider: %s is not enabled for the application": "Le fournisseur :%s n'est pas activé pour l'application",
     "Unauthorized operation": "Opération non autorisée",

i18n/locales/he/data.json

@@ -16,12 +16,14 @@
     "The account for provider: %s and username: %s (%s) does not exist and is not allowed to sign up as new account, please contact your IT support": "החשבון עבור ספק: %s ושם משתמש: %s (%s) אינו קיים ואינו מאופשר להרשמה כחשבון חדש, אנא צור קשר עם התמיכה הטכנית",
     "The account for provider: %s and username: %s (%s) is already linked to another account: %s (%s)": "החשבון עבור ספק: %s ושם משתמש: %s (%s) כבר מקושר לחשבון אחר: %s (%s)",
     "The application: %s does not exist": "האפליקציה: %s אינה קיימת",
+    "The application: %s has disabled users to signin": "The application: %s has disabled users to signin",
     "The login method: login with LDAP is not enabled for the application": "שיטת הכניסה: כניסה עם LDAP אינה מאופשרת לאפליקציה",
     "The login method: login with SMS is not enabled for the application": "שיטת הכניסה: כניסה עם SMS אינה מאופשרת לאפליקציה",
     "The login method: login with email is not enabled for the application": "שיטת הכניסה: כניסה עם אימייל אינה מאופשרת לאפליקציה",
     "The login method: login with face is not enabled for the application": "שיטת הכניסה: כניסה עם פנים אינה מאופשרת לאפליקציה",
     "The login method: login with password is not enabled for the application": "שיטת הכניסה: כניסה עם סיסמה אינה מאופשרת לאפליקציה",
     "The organization: %s does not exist": "הארגון: %s אינו קיים",
+    "The organization: %s has disabled users to signin": "The organization: %s has disabled users to signin",
     "The provider: %s does not exist": "הספק: %s אינו קיים",
     "The provider: %s is not enabled for the application": "הספק: %s אינו מאופשר לאפליקציה",
     "Unauthorized operation": "פעולה לא מורשית",

i18n/locales/id/data.json

@@ -16,12 +16,14 @@
     "The account for provider: %s and username: %s (%s) does not exist and is not allowed to sign up as new account, please contact your IT support": "Akun untuk penyedia: %s dan nama pengguna: %s (%s) tidak ada dan tidak diizinkan untuk mendaftar sebagai akun baru, silakan hubungi dukungan IT Anda",
     "The account for provider: %s and username: %s (%s) is already linked to another account: %s (%s)": "Akun untuk penyedia: %s dan username: %s (%s) sudah terhubung dengan akun lain: %s (%s)",
     "The application: %s does not exist": "Aplikasi: %s tidak ada",
+    "The application: %s has disabled users to signin": "The application: %s has disabled users to signin",
     "The login method: login with LDAP is not enabled for the application": "Metode masuk: masuk dengan LDAP tidak diaktifkan untuk aplikasi ini",
     "The login method: login with SMS is not enabled for the application": "Metode masuk: masuk dengan SMS tidak diaktifkan untuk aplikasi ini",
     "The login method: login with email is not enabled for the application": "Metode masuk: masuk dengan email tidak diaktifkan untuk aplikasi ini",
     "The login method: login with face is not enabled for the application": "Metode masuk: masuk dengan wajah tidak diaktifkan untuk aplikasi ini",
     "The login method: login with password is not enabled for the application": "Metode login: login dengan sandi tidak diaktifkan untuk aplikasi tersebut",
     "The organization: %s does not exist": "Organisasi: %s tidak ada",
+    "The organization: %s has disabled users to signin": "The organization: %s has disabled users to signin",
     "The provider: %s does not exist": "Penyedia: %s tidak ada",
     "The provider: %s is not enabled for the application": "Penyedia: %s tidak diaktifkan untuk aplikasi ini",
     "Unauthorized operation": "Operasi tidak sah",

i18n/locales/it/data.json

@@ -16,12 +16,14 @@
     "The account for provider: %s and username: %s (%s) does not exist and is not allowed to sign up as new account, please contact your IT support": "Account per provider: %s e utente: %s (%s) non esiste, registrazione non consentita: contatta l'assistenza IT",
     "The account for provider: %s and username: %s (%s) is already linked to another account: %s (%s)": "Account per provider: %s e utente: %s (%s) già collegato a un altro account: %s (%s)",
     "The application: %s does not exist": "L'app: %s non esiste",
+    "The application: %s has disabled users to signin": "The application: %s has disabled users to signin",
     "The login method: login with LDAP is not enabled for the application": "Metodo di accesso: login con LDAP non abilitato per l'applicazione",
     "The login method: login with SMS is not enabled for the application": "Metodo di accesso: login con SMS non abilitato per l'applicazione",
     "The login method: login with email is not enabled for the application": "Metodo di accesso: login con email non abilitato per l'applicazione",
     "The login method: login with face is not enabled for the application": "Metodo di accesso: login con riconoscimento facciale non abilitato per l'applicazione",
     "The login method: login with password is not enabled for the application": "Login con password non abilitato per questa app",
     "The organization: %s does not exist": "L'organizzazione: %s non esiste",
+    "The organization: %s has disabled users to signin": "The organization: %s has disabled users to signin",
     "The provider: %s does not exist": "Il provider: %s non esiste",
     "The provider: %s is not enabled for the application": "Il provider: %s non è abilitato per l'app",
     "Unauthorized operation": "Operazione non autorizzata",

i18n/locales/ja/data.json

@@ -16,12 +16,14 @@
     "The account for provider: %s and username: %s (%s) does not exist and is not allowed to sign up as new account, please contact your IT support": "プロバイダー名：%sとユーザー名：%s（%s）のアカウントは存在しません。新しいアカウントとしてサインアップすることはできません。 ITサポートに連絡してください",
     "The account for provider: %s and username: %s (%s) is already linked to another account: %s (%s)": "プロバイダのアカウント：%s とユーザー名：%s (%s) は既に別のアカウント：%s (%s) にリンクされています",
     "The application: %s does not exist": "アプリケーション: %sは存在しません",
+    "The application: %s has disabled users to signin": "The application: %s has disabled users to signin",
     "The login method: login with LDAP is not enabled for the application": "このアプリケーションでは LDAP ログインは有効になっていません",
     "The login method: login with SMS is not enabled for the application": "このアプリケーションでは SMS ログインは有効になっていません",
     "The login method: login with email is not enabled for the application": "このアプリケーションではメールログインは有効になっていません",
     "The login method: login with face is not enabled for the application": "このアプリケーションでは顔認証ログインは有効になっていません",
     "The login method: login with password is not enabled for the application": "ログイン方法：パスワードでのログインはアプリケーションで有効になっていません",
     "The organization: %s does not exist": "組織「%s」は存在しません",
+    "The organization: %s has disabled users to signin": "The organization: %s has disabled users to signin",
     "The provider: %s does not exist": "プロバイダ「%s」は存在しません",
     "The provider: %s is not enabled for the application": "プロバイダー：%sはアプリケーションでは有効化されていません",
     "Unauthorized operation": "不正操作",

i18n/locales/kk/data.json

@@ -16,12 +16,14 @@
     "The account for provider: %s and username: %s (%s) does not exist and is not allowed to sign up as new account, please contact your IT support": "Account voor provider: %s en gebruikersnaam: %s (%s) bestaat niet en mag niet registreren, contacteer IT-support",
     "The account for provider: %s and username: %s (%s) is already linked to another account: %s (%s)": "Account voor provider: %s en gebruikersnaam: %s (%s) is al gelinkt aan ander account: %s (%s)",
     "The application: %s does not exist": "Applicatie: %s bestaat niet",
+    "The application: %s has disabled users to signin": "The application: %s has disabled users to signin",
     "The login method: login with LDAP is not enabled for the application": "Inloggen via LDAP is niet ingeschakeld voor deze applicatie",
     "The login method: login with SMS is not enabled for the application": "Inloggen via SMS is niet ingeschakeld voor deze applicatie",
     "The login method: login with email is not enabled for the application": "Inloggen via e-mail is niet ingeschakeld voor deze applicatie",
     "The login method: login with face is not enabled for the application": "Inloggen via gezichtsherkenning is niet ingeschakeld voor deze applicatie",
     "The login method: login with password is not enabled for the application": "Inloggen via wachtwoord is niet ingeschakeld voor deze applicatie",
     "The organization: %s does not exist": "Organisatie: %s bestaat niet",
+    "The organization: %s has disabled users to signin": "The organization: %s has disabled users to signin",
     "The provider: %s does not exist": "Provider: %s bestaat niet",
     "The provider: %s is not enabled for the application": "Provider: %s is niet ingeschakeld voor de applicatie",
     "Unauthorized operation": "Ongeautoriseerde handeling",

i18n/locales/ko/data.json

@@ -16,12 +16,14 @@
     "The account for provider: %s and username: %s (%s) does not exist and is not allowed to sign up as new account, please contact your IT support": "공급자 계정 %s과 사용자 이름 %s (%s)는 존재하지 않으며 새 계정으로 등록할 수 없습니다. IT 지원팀에 문의하십시오",
     "The account for provider: %s and username: %s (%s) is already linked to another account: %s (%s)": "공급자 계정 %s과 사용자 이름 %s(%s)는 이미 다른 계정 %s(%s)에 연결되어 있습니다",
     "The application: %s does not exist": "해당 애플리케이션(%s)이 존재하지 않습니다",
+    "The application: %s has disabled users to signin": "The application: %s has disabled users to signin",
     "The login method: login with LDAP is not enabled for the application": "LDAP를 이용한 로그인 방식이 이 애플리케이션에 활성화되어 있지 않습니다",
     "The login method: login with SMS is not enabled for the application": "SMS를 이용한 로그인 방식이 이 애플리케이션에 활성화되어 있지 않습니다",
     "The login method: login with email is not enabled for the application": "이메일을 이용한 로그인 방식이 이 애플리케이션에 활성화되어 있지 않습니다",
     "The login method: login with face is not enabled for the application": "얼굴 인식을 이용한 로그인 방식이 이 애플리케이션에 활성화되어 있지 않습니다",
     "The login method: login with password is not enabled for the application": "어플리케이션에서는 암호를 사용한 로그인 방법이 활성화되어 있지 않습니다",
     "The organization: %s does not exist": "조직 %s이(가) 존재하지 않습니다",
+    "The organization: %s has disabled users to signin": "The organization: %s has disabled users to signin",
     "The provider: %s does not exist": "제공자 %s이(가) 존재하지 않습니다",
     "The provider: %s is not enabled for the application": "제공자 %s은(는) 응용 프로그램에서 활성화되어 있지 않습니다",
     "Unauthorized operation": "무단 조작",

i18n/locales/ms/data.json

@@ -16,12 +16,14 @@
     "The account for provider: %s and username: %s (%s) does not exist and is not allowed to sign up as new account, please contact your IT support": "Akaun untuk pembekal: %s dan nama pengguna: %s (%s) tidak wujud dan tidak dibenarkan daftar, sila hubungi sokongan IT",
     "The account for provider: %s and username: %s (%s) is already linked to another account: %s (%s)": "Akaun untuk pembekal: %s dan nama pengguna: %s (%s) sudah dipautkan kepada akaun lain: %s (%s)",
     "The application: %s does not exist": "Aplikasi: %s tidak wujud",
+    "The application: %s has disabled users to signin": "The application: %s has disabled users to signin",
     "The login method: login with LDAP is not enabled for the application": "Kaedah log masuk LDAP tidak dibenarkan untuk aplikasi ini",
     "The login method: login with SMS is not enabled for the application": "Kaedah log masuk SMS tidak dibenarkan untuk aplikasi ini",
     "The login method: login with email is not enabled for the application": "Kaedah log masuk emel tidak dibenarkan untuk aplikasi ini",
     "The login method: login with face is not enabled for the application": "Kaedah log masuk muka tidak dibenarkan untuk aplikasi ini",
     "The login method: login with password is not enabled for the application": "Kaedah log masuk kata laluan tidak dibenarkan untuk aplikasi ini",
     "The organization: %s does not exist": "Organisasi: %s tidak wujud",
+    "The organization: %s has disabled users to signin": "The organization: %s has disabled users to signin",
     "The provider: %s does not exist": "Pembekal: %s tidak wujud",
     "The provider: %s is not enabled for the application": "Pembekal: %s tidak dibenarkan untuk aplikasi ini",
     "Unauthorized operation": "Operasi tidak dibenarkan",

i18n/locales/nl/data.json

@@ -16,12 +16,14 @@
     "The account for provider: %s and username: %s (%s) does not exist and is not allowed to sign up as new account, please contact your IT support": "Gebruiker bestaat niet; aanmelden niet toegestaan, neem contact op met IT",
     "The account for provider: %s and username: %s (%s) is already linked to another account: %s (%s)": "Account al gekoppeld aan andere gebruiker: %s (%s)",
     "The application: %s does not exist": "Applicatie %s bestaat niet",
+    "The application: %s has disabled users to signin": "The application: %s has disabled users to signin",
     "The login method: login with LDAP is not enabled for the application": "LDAP-login uitgeschakeld voor deze app",
     "The login method: login with SMS is not enabled for the application": "SMS-login uitgeschakeld voor deze app",
     "The login method: login with email is not enabled for the application": "E-mail-login uitgeschakeld voor deze app",
     "The login method: login with face is not enabled for the application": "Face-login uitgeschakeld voor deze app",
     "The login method: login with password is not enabled for the application": "Wachtwoord-login uitgeschakeld voor deze app",
     "The organization: %s does not exist": "Organisatie %s bestaat niet",
+    "The organization: %s has disabled users to signin": "The organization: %s has disabled users to signin",
     "The provider: %s does not exist": "Provider %s bestaat niet",
     "The provider: %s is not enabled for the application": "Provider %s uitgeschakeld voor deze app",
     "Unauthorized operation": "Niet toegestane handeling",

i18n/locales/pl/data.json

@@ -16,12 +16,14 @@
     "The account for provider: %s and username: %s (%s) does not exist and is not allowed to sign up as new account, please contact your IT support": "Konto dla dostawcy: %s i nazwy użytkownika: %s (%s) nie istnieje i nie można się zarejestrować jako nowe konto, skontaktuj się z pomocą IT",
     "The account for provider: %s and username: %s (%s) is already linked to another account: %s (%s)": "Konto dla dostawcy: %s i nazwy użytkownika: %s (%s) jest już powiązane z innym kontem: %s (%s)",
     "The application: %s does not exist": "Aplikacja: %s nie istnieje",
+    "The application: %s has disabled users to signin": "The application: %s has disabled users to signin",
     "The login method: login with LDAP is not enabled for the application": "Metoda logowania: logowanie przez LDAP nie jest włączone dla aplikacji",
     "The login method: login with SMS is not enabled for the application": "Metoda logowania: logowanie przez SMS nie jest włączona dla aplikacji",
     "The login method: login with email is not enabled for the application": "Metoda logowania: logowanie przez email nie jest włączona dla aplikacji",
     "The login method: login with face is not enabled for the application": "Metoda logowania: logowanie przez twarz nie jest włączona dla aplikacji",
     "The login method: login with password is not enabled for the application": "Metoda logowania: logowanie przez hasło nie jest włączone dla aplikacji",
     "The organization: %s does not exist": "Organizacja: %s nie istnieje",
+    "The organization: %s has disabled users to signin": "The organization: %s has disabled users to signin",
     "The provider: %s does not exist": "Dostawca: %s nie istnieje",
     "The provider: %s is not enabled for the application": "Dostawca: %s nie jest włączony dla aplikacji",
     "Unauthorized operation": "Nieautoryzowana operacja",

i18n/locales/pt/data.json

@@ -16,12 +16,14 @@
     "The account for provider: %s and username: %s (%s) does not exist and is not allowed to sign up as new account, please contact your IT support": "A conta para o provedor: %s e nome de usuário: %s (%s) não existe e não é permitido inscrever-se como uma nova conta entre em contato com seu suporte de TI",
     "The account for provider: %s and username: %s (%s) is already linked to another account: %s (%s)": "A conta do provedor: %s e nome de usuário: %s (%s) já está vinculada a outra conta: %s (%s)",
     "The application: %s does not exist": "O aplicativo: %s não existe",
+    "The application: %s has disabled users to signin": "The application: %s has disabled users to signin",
     "The login method: login with LDAP is not enabled for the application": "O método de login: login com LDAP não está ativado para a aplicação",
     "The login method: login with SMS is not enabled for the application": "O método de login: login com SMS não está ativado para a aplicação",
     "The login method: login with email is not enabled for the application": "O método de login: login com e-mail não está ativado para a aplicação",
     "The login method: login with face is not enabled for the application": "O método de login: login com reconhecimento facial não está ativado para a aplicação",
     "The login method: login with password is not enabled for the application": "O método de login: login com senha não está habilitado para o aplicativo",
     "The organization: %s does not exist": "A organização: %s não existe",
+    "The organization: %s has disabled users to signin": "The organization: %s has disabled users to signin",
     "The provider: %s does not exist": "O provedor: %s não existe",
     "The provider: %s is not enabled for the application": "O provedor: %s não está habilitado para o aplicativo",
     "Unauthorized operation": "Operação não autorizada",

i18n/locales/ru/data.json

@@ -16,12 +16,14 @@
     "The account for provider: %s and username: %s (%s) does not exist and is not allowed to sign up as new account, please contact your IT support": "Аккаунт для провайдера: %s и имя пользователя: %s (%s) не существует и не может быть зарегистрирован как новый аккаунт. Пожалуйста, обратитесь в службу поддержки IT",
     "The account for provider: %s and username: %s (%s) is already linked to another account: %s (%s)": "Аккаунт поставщика: %s и имя пользователя: %s (%s) уже связаны с другим аккаунтом: %s (%s)",
     "The application: %s does not exist": "Приложение: %s не существует",
+    "The application: %s has disabled users to signin": "The application: %s has disabled users to signin",
     "The login method: login with LDAP is not enabled for the application": "Метод входа через LDAP отключен для этого приложения",
     "The login method: login with SMS is not enabled for the application": "Метод входа через SMS отключен для этого приложения",
     "The login method: login with email is not enabled for the application": "Метод входа через электронную почту отключен для этого приложения",
     "The login method: login with face is not enabled for the application": "Метод входа через распознавание лица отключен для этого приложения",
     "The login method: login with password is not enabled for the application": "Метод входа: вход с паролем не включен для приложения",
     "The organization: %s does not exist": "Организация: %s не существует",
+    "The organization: %s has disabled users to signin": "The organization: %s has disabled users to signin",
     "The provider: %s does not exist": "Провайдер: %s не существует",
     "The provider: %s is not enabled for the application": "Провайдер: %s не включен для приложения",
     "Unauthorized operation": "Несанкционированная операция",

i18n/locales/sk/data.json

@@ -16,12 +16,14 @@
     "The account for provider: %s and username: %s (%s) does not exist and is not allowed to sign up as new account, please contact your IT support": "Účet pre poskytovateľa: %s a používateľské meno: %s (%s) neexistuje a nie je povolené zaregistrovať nový účet, prosím kontaktujte vašu IT podporu",
     "The account for provider: %s and username: %s (%s) is already linked to another account: %s (%s)": "Účet pre poskytovateľa: %s a používateľské meno: %s (%s) je už prepojený s iným účtom: %s (%s)",
     "The application: %s does not exist": "Aplikácia: %s neexistuje",
+    "The application: %s has disabled users to signin": "The application: %s has disabled users to signin",
     "The login method: login with LDAP is not enabled for the application": "Metóda prihlásenia: prihlásenie pomocou LDAP nie je pre aplikáciu povolená",
     "The login method: login with SMS is not enabled for the application": "Metóda prihlásenia: prihlásenie pomocou SMS nie je pre aplikáciu povolená",
     "The login method: login with email is not enabled for the application": "Metóda prihlásenia: prihlásenie pomocou e-mailu nie je pre aplikáciu povolená",
     "The login method: login with face is not enabled for the application": "Metóda prihlásenia: prihlásenie pomocou tváre nie je pre aplikáciu povolená",
     "The login method: login with password is not enabled for the application": "Metóda prihlásenia: prihlásenie pomocou hesla nie je pre aplikáciu povolená",
     "The organization: %s does not exist": "Organizácia: %s neexistuje",
+    "The organization: %s has disabled users to signin": "The organization: %s has disabled users to signin",
     "The provider: %s does not exist": "Poskytovatel: %s neexistuje",
     "The provider: %s is not enabled for the application": "Poskytovateľ: %s nie je pre aplikáciu povolený",
     "Unauthorized operation": "Neautorizovaná operácia",

i18n/locales/sv/data.json

@@ -16,12 +16,14 @@
     "The account for provider: %s and username: %s (%s) does not exist and is not allowed to sign up as new account, please contact your IT support": "Kontot för leverantör: %s och användarnamn: %s (%s) finns inte och det är inte tillåtet att registrera ett nytt konto, kontakta din IT-support",
     "The account for provider: %s and username: %s (%s) is already linked to another account: %s (%s)": "Kontot för leverantör: %s och användarnamn: %s (%s) är redan länkat till ett annat konto: %s (%s)",
     "The application: %s does not exist": "Applikationen: %s finns inte",
+    "The application: %s has disabled users to signin": "The application: %s has disabled users to signin",
     "The login method: login with LDAP is not enabled for the application": "Inloggningsmetoden: inloggning med LDAP är inte aktiverad för applikationen",
     "The login method: login with SMS is not enabled for the application": "Inloggningsmetoden: inloggning med SMS är inte aktiverad för applikationen",
     "The login method: login with email is not enabled for the application": "Inloggningsmetoden: inloggning med e-post är inte aktiverad för applikationen",
     "The login method: login with face is not enabled for the application": "Inloggningsmetoden: inloggning med ansikte är inte aktiverad för applikationen",
     "The login method: login with password is not enabled for the application": "Inloggningsmetoden: inloggning med lösenord är inte aktiverad för applikationen",
     "The organization: %s does not exist": "Organisationen: %s finns inte",
+    "The organization: %s has disabled users to signin": "The organization: %s has disabled users to signin",
     "The provider: %s does not exist": "Leverantören: %s finns inte",
     "The provider: %s is not enabled for the application": "Leverantören: %s är inte aktiverad för applikationen",
     "Unauthorized operation": "Obehörig åtgärd",

i18n/locales/tr/data.json

@@ -16,12 +16,14 @@
     "The account for provider: %s and username: %s (%s) does not exist and is not allowed to sign up as new account, please contact your IT support": "Provider: %s ve kullanıcı adı: %s (%s) için hesap mevcut değil ve yeni hesap açılmasına izin verilmiyor, lütfen BT destek ile iletişime geçin",
     "The account for provider: %s and username: %s (%s) is already linked to another account: %s (%s)": "Provider: %s ve kullanıcı adı: %s (%s) zaten başka bir hesaba bağlı: %s (%s)",
     "The application: %s does not exist": "Uygulama: %s bulunamadı",
+    "The application: %s has disabled users to signin": "The application: %s has disabled users to signin",
     "The login method: login with LDAP is not enabled for the application": "Uygulama için LDAP ile giriş yöntemi etkin değil",
     "The login method: login with SMS is not enabled for the application": "Uygulama için SMS ile giriş yöntemi etkin değil",
     "The login method: login with email is not enabled for the application": "Uygulama için e-posta ile giriş yöntemi etkin değil",
     "The login method: login with face is not enabled for the application": "Uygulama için yüz ile giriş yöntemi etkin değil",
     "The login method: login with password is not enabled for the application": "Şifre ile giriş yöntemi bu uygulama için etkin değil",
     "The organization: %s does not exist": "Organizasyon: %s mevcut değil",
+    "The organization: %s has disabled users to signin": "The organization: %s has disabled users to signin",
     "The provider: %s does not exist": "Sağlayıcı: %s mevcut değil",
     "The provider: %s is not enabled for the application": "Provider: %s bu uygulama için etkin değil",
     "Unauthorized operation": "Yetkisiz işlem",

i18n/locales/uk/data.json

@@ -16,12 +16,14 @@
     "The account for provider: %s and username: %s (%s) does not exist and is not allowed to sign up as new account, please contact your IT support": "Обліковий запис для провайдера: %s та імені користувача: %s (%s) не існує і не дозволяється реєструвати як новий, зверніться до IT-підтримки",
     "The account for provider: %s and username: %s (%s) is already linked to another account: %s (%s)": "Обліковий запис для провайдера: %s та імені користувача: %s (%s) уже пов’язаний з іншим обліковим записом: %s (%s)",
     "The application: %s does not exist": "Додаток: %s не існує",
+    "The application: %s has disabled users to signin": "The application: %s has disabled users to signin",
     "The login method: login with LDAP is not enabled for the application": "Метод входу через LDAP не увімкнено для цього додатка",
     "The login method: login with SMS is not enabled for the application": "Метод входу через SMS не увімкнено для цього додатка",
     "The login method: login with email is not enabled for the application": "Метод входу через email не увімкнено для цього додатка",
     "The login method: login with face is not enabled for the application": "Метод входу через обличчя не увімкнено для цього додатка",
     "The login method: login with password is not enabled for the application": "Метод входу через пароль не увімкнено для цього додатка",
     "The organization: %s does not exist": "Організація: %s не існує",
+    "The organization: %s has disabled users to signin": "The organization: %s has disabled users to signin",
     "The provider: %s does not exist": "Провайдер: %s не існує",
     "The provider: %s is not enabled for the application": "Провайдер: %s не увімкнено для цього додатка",
     "Unauthorized operation": "Неавторизована операція",

i18n/locales/vi/data.json

@@ -16,12 +16,14 @@
     "The account for provider: %s and username: %s (%s) does not exist and is not allowed to sign up as new account, please contact your IT support": "Tài khoản cho nhà cung cấp: %s và tên người dùng: %s (%s) không tồn tại và không được phép đăng ký như một tài khoản mới, vui lòng liên hệ với bộ phận hỗ trợ công nghệ thông tin của bạn",
     "The account for provider: %s and username: %s (%s) is already linked to another account: %s (%s)": "Tài khoản cho nhà cung cấp: %s và tên người dùng: %s (%s) đã được liên kết với tài khoản khác: %s (%s)",
     "The application: %s does not exist": "Ứng dụng: %s không tồn tại",
+    "The application: %s has disabled users to signin": "The application: %s has disabled users to signin",
     "The login method: login with LDAP is not enabled for the application": "Phương thức đăng nhập bằng LDAP chưa được bật cho ứng dụng",
     "The login method: login with SMS is not enabled for the application": "Phương thức đăng nhập bằng SMS chưa được bật cho ứng dụng",
     "The login method: login with email is not enabled for the application": "Phương thức đăng nhập bằng email chưa được bật cho ứng dụng",
     "The login method: login with face is not enabled for the application": "Phương thức đăng nhập bằng khuôn mặt chưa được bật cho ứng dụng",
     "The login method: login with password is not enabled for the application": "Phương thức đăng nhập: đăng nhập bằng mật khẩu không được kích hoạt cho ứng dụng",
     "The organization: %s does not exist": "Tổ chức: %s không tồn tại",
+    "The organization: %s has disabled users to signin": "The organization: %s has disabled users to signin",
     "The provider: %s does not exist": "Nhà cung cấp: %s không tồn tại",
     "The provider: %s is not enabled for the application": "Nhà cung cấp: %s không được kích hoạt cho ứng dụng",
     "Unauthorized operation": "Hoạt động không được ủy quyền",

i18n/locales/zh/data.json

@@ -16,12 +16,14 @@
     "The account for provider: %s and username: %s (%s) does not exist and is not allowed to sign up as new account, please contact your IT support": "提供商账户: %s 与用户名: %s (%s) 不存在且 不允许注册新账户, 请联系IT支持",
     "The account for provider: %s and username: %s (%s) is already linked to another account: %s (%s)": "提供商账户: %s与用户名: %s (%s)已经与其他账户绑定: %s (%s)",
     "The application: %s does not exist": "应用%s不存在",
+    "The application: %s has disabled users to signin": "应用: %s 禁止用户登录",
     "The login method: login with LDAP is not enabled for the application": "该应用禁止采用LDAP登录方式",
     "The login method: login with SMS is not enabled for the application": "该应用禁止采用短信登录方式",
     "The login method: login with email is not enabled for the application": "该应用禁止采用邮箱登录方式",
     "The login method: login with face is not enabled for the application": "该应用禁止采用人脸登录",
     "The login method: login with password is not enabled for the application": "该应用禁止采用密码登录方式",
     "The organization: %s does not exist": "组织: %s 不存在",
+    "The organization: %s has disabled users to signin": "组织: %s 禁止用户登录",
     "The provider: %s does not exist": "提供商: %s 不存在",
     "The provider: %s is not enabled for the application": "该应用的提供商: %s未被启用",
     "Unauthorized operation": "未授权的操作",

init_data.json.template

@@ -73,6 +73,7 @@
       "initScore": 2000,
       "enableSoftDeletion": false,
       "isProfilePublic": true,
+      "disableSignin": false,
       "accountItems": []
     }
   ],
@@ -87,6 +88,7 @@
       "cert": "",
       "enablePassword": true,
       "enableSignUp": true,
+      "disableSignin": false,
       "clientId": "",
       "clientSecret": "",
       "providers": [

ldap/server.go

@@ -159,6 +159,11 @@ func handleSearch(w ldap.ResponseWriter, m *ldap.Message) {
 	default:
 	}
 
+	if strings.EqualFold(r.FilterString(), "(objectClass=*)") && (string(r.BaseObject()) == "" || strings.EqualFold(string(r.BaseObject()), "cn=Subschema")) {
+		handleRootSearch(w, &r, &res, m)
+		return
+	}
+
 	var isGroupSearch bool = false
 	filter := r.Filter()
 	if eq, ok := filter.(message.FilterEqualityMatch); ok && strings.EqualFold(string(eq.AttributeDesc()), "objectClass") && strings.EqualFold(string(eq.AssertionValue()), "posixGroup") {
@@ -229,6 +234,46 @@ func handleSearch(w ldap.ResponseWriter, m *ldap.Message) {
 	w.Write(res)
 }
 
+func handleRootSearch(w ldap.ResponseWriter, r *message.SearchRequest, res *message.SearchResultDone, m *ldap.Message) {
+	if len(r.Attributes()) == 0 {
+		w.Write(res)
+		return
+	}
+	firstAttr := string(r.Attributes()[0])
+
+	if string(r.BaseObject()) == "" {
+		// Handle special root DSE requests
+		if strings.EqualFold(firstAttr, "namingContexts") {
+			orgs, code := GetFilteredOrganizations(m)
+			if code != ldap.LDAPResultSuccess {
+				res.SetResultCode(code)
+				w.Write(res)
+				return
+			}
+			e := ldap.NewSearchResultEntry(string(r.BaseObject()))
+			dnlist := make([]message.AttributeValue, len(orgs))
+			for i, org := range orgs {
+				dnlist[i] = message.AttributeValue(fmt.Sprintf("ou=%s", org.Name))
+			}
+			e.AddAttribute("namingContexts", dnlist...)
+			w.Write(e)
+		} else if strings.EqualFold(firstAttr, "subschemaSubentry") {
+			e := ldap.NewSearchResultEntry(string(r.BaseObject()))
+			e.AddAttribute("subschemaSubentry", message.AttributeValue("cn=Subschema"))
+			w.Write(e)
+		}
+	} else if strings.EqualFold(firstAttr, "objectclasses") && strings.EqualFold(string(r.BaseObject()), "cn=Subschema") {
+		e := ldap.NewSearchResultEntry(string(r.BaseObject()))
+		e.AddAttribute("objectClasses", []message.AttributeValue{
+			"( 1.3.6.1.1.1.2.0 NAME 'posixAccount' DESC 'Abstraction of an account with POSIX attributes' SUP top AUXILIARY MUST ( cn $ uid $ uidNumber $ gidNumber $ homeDirectory ) MAY ( userPassword $ loginShell $ gecos $ description ) )",
+			"( 1.3.6.1.1.1.2.2 NAME 'posixGroup' DESC 'Abstraction of a group of accounts' SUP top STRUCTURAL MUST ( cn $ gidNumber ) MAY ( userPassword $ memberUid $ description ) )",
+		}...)
+		w.Write(e)
+	}
+
+	w.Write(res)
+}
+
 func hash(s string) uint32 {
 	h := fnv.New32a()
 	h.Write([]byte(s))

ldap/util.go

@@ -358,6 +358,29 @@ func GetFilteredGroups(m *ldap.Message, baseDN string, filterStr string) ([]*obj
 	return groups, ldap.LDAPResultSuccess
 }
 
+func GetFilteredOrganizations(m *ldap.Message) ([]*object.Organization, int) {
+	if m.Client.IsGlobalAdmin {
+		organizations, err := object.GetOrganizations("")
+		if err != nil {
+			panic(err)
+		}
+		return organizations, ldap.LDAPResultSuccess
+	} else if m.Client.IsOrgAdmin {
+		requestUserId := util.GetId(m.Client.OrgName, m.Client.UserName)
+		user, err := object.GetUser(requestUserId)
+		if err != nil {
+			panic(err)
+		}
+		organization, err := object.GetOrganizationByUser(user)
+		if err != nil {
+			panic(err)
+		}
+		return []*object.Organization{organization}, ldap.LDAPResultSuccess
+	} else {
+		return nil, ldap.LDAPResultInsufficientAccessRights
+	}
+}
+
 // get user password with hash type prefix
 // TODO not handle salt yet
 // @return {md5}5f4dcc3b5aa765d61d8327deb882cf99

object/application.go

@@ -75,6 +75,7 @@ type Application struct {
 	HeaderHtml            string          `xorm:"mediumtext" json:"headerHtml"`
 	EnablePassword        bool            `json:"enablePassword"`
 	EnableSignUp          bool            `json:"enableSignUp"`
+	DisableSignin         bool            `json:"disableSignin"`
 	EnableSigninSession   bool            `json:"enableSigninSession"`
 	EnableAutoSignin      bool            `json:"enableAutoSignin"`
 	EnableCodeSignin      bool            `json:"enableCodeSignin"`

object/organization.go

@@ -80,6 +80,7 @@ type Organization struct {
 	IsProfilePublic        bool       `json:"isProfilePublic"`
 	UseEmailAsUsername     bool       `json:"useEmailAsUsername"`
 	EnableTour             bool       `json:"enableTour"`
+	DisableSignin          bool       `json:"disableSignin"`
 	IpRestriction          string     `json:"ipRestriction"`
 	NavItems               []string   `xorm:"mediumtext" json:"navItems"`
 	WidgetItems            []string   `xorm:"mediumtext" json:"widgetItems"`

object/token_jwt.go

@@ -20,6 +20,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/casdoor/casdoor/conf"
 	"github.com/casdoor/casdoor/util"
 	"github.com/golang-jwt/jwt/v5"
 )
@@ -341,10 +342,31 @@ func getClaimsCustom(claims Claims, tokenField []string) jwt.MapClaims {
 	res["provider"] = claims.Provider
 
 	for _, field := range tokenField {
-		userField := userValue.FieldByName(field)
-		if userField.IsValid() {
-			newfield := util.SnakeToCamel(util.CamelToSnakeCase(field))
-			res[newfield] = userField.Interface()
+		if strings.HasPrefix(field, "Properties") {
+			/*
+				Use selected properties fields as custom claims.
+				Converts `Properties.my_field` to custom claim with name `my_field`.
+			*/
+			parts := strings.Split(field, ".")
+			if len(parts) != 2 || parts[0] != "Properties" { // Either too many segments, or not properly scoped to `Properties`, so skip.
+				continue
+			}
+			base, fieldName := parts[0], parts[1]
+			mField := userValue.FieldByName(base)
+			if !mField.IsValid() { // Can't find `Properties` field, so skip.
+				continue
+			}
+			finalField := mField.MapIndex(reflect.ValueOf(fieldName))
+			if finalField.IsValid() { // // Provided field within `Properties` exists, add claim.
+				res[fieldName] = finalField.Interface()
+			}
+
+		} else { // Use selected user field as claims.
+			userField := userValue.FieldByName(field)
+			if userField.IsValid() {
+				newfield := util.SnakeToCamel(util.CamelToSnakeCase(field))
+				res[newfield] = userField.Interface()
+			}
 		}
 	}
 
@@ -381,6 +403,14 @@ func generateJwtToken(application *Application, user *User, provider string, non
 		refreshExpireTime = expireTime
 	}
 
+	if conf.GetConfigBool("useGroupPathInToken") {
+		groupPath, err := user.GetUserFullGroupPath()
+		if err != nil {
+			return "", "", "", err
+		}
+
+		user.Groups = groupPath
+	}
 	user = refineUser(user)
 
 	_, originBackend := getOriginFromHost(host)

object/user.go

@@ -1331,6 +1331,56 @@ func (user *User) CheckUserFace(faceIdImage []string, provider *Provider) (bool,
 	return false, nil
 }
 
+func (user *User) GetUserFullGroupPath() ([]string, error) {
+	if len(user.Groups) == 0 {
+		return []string{}, nil
+	}
+
+	var orgGroups []*Group
+	orgGroups, err := GetGroups(user.Owner)
+	if err != nil {
+		return nil, err
+	}
+
+	groupMap := make(map[string]Group)
+	for _, group := range orgGroups {
+		groupMap[group.Name] = *group
+	}
+
+	var groupFullPath []string
+
+	for _, groupId := range user.Groups {
+		_, groupName := util.GetOwnerAndNameFromIdNoCheck(groupId)
+		group, ok := groupMap[groupName]
+		if !ok {
+			continue
+		}
+
+		groupPath := groupName
+
+		curGroup, ok := groupMap[group.ParentId]
+		if !ok {
+			return []string{}, fmt.Errorf("group:Group %s not exist", group.ParentId)
+		}
+		for {
+			groupPath = util.GetId(curGroup.Name, groupPath)
+			if curGroup.IsTopGroup {
+				break
+			}
+
+			curGroup, ok = groupMap[curGroup.ParentId]
+			if !ok {
+				return []string{}, fmt.Errorf("group:Group %s not exist", curGroup.ParentId)
+			}
+		}
+
+		groupPath = util.GetId(curGroup.Owner, groupPath)
+		groupFullPath = append(groupFullPath, groupPath)
+	}
+
+	return groupFullPath, nil
+}
+
 func GenerateIdForNewUser(application *Application) (string, error) {
 	if application == nil || application.GetSignupItemRule("ID") != "Incremental" {
 		return util.GenerateId(), nil

web/src/ApplicationEditPage.js

@@ -543,6 +543,16 @@ class ApplicationEditPage extends React.Component {
             }} />
           </Col>
         </Row>
+        <Row style={{marginTop: "20px"}} >
+          <Col style={{marginTop: "5px"}} span={(Setting.isMobile()) ? 19 : 2}>
+            {Setting.getLabel(i18next.t("application:Disable signin"), i18next.t("application:Disable signin - Tooltip"))} :
+          </Col>
+          <Col span={1} >
+            <Switch checked={this.state.application.disableSignin} onChange={checked => {
+              this.updateApplicationField("disableSignin", checked);
+            }} />
+          </Col>
+        </Row>
         <Row style={{marginTop: "20px"}} >
           <Col style={{marginTop: "5px"}} span={(Setting.isMobile()) ? 19 : 2}>
             {Setting.getLabel(i18next.t("application:Signin session"), i18next.t("application:Enable signin session - Tooltip"))} :

web/src/ApplicationListPage.js

@@ -41,6 +41,7 @@ class ApplicationListPage extends BaseListPage {
       logo: `${Setting.StaticBaseUrl}/img/casdoor-logo_1185x256.png`,
       enablePassword: true,
       enableSignUp: true,
+      disableSignin: false,
       enableSigninSession: false,
       enableCodeSignin: false,
       enableSamlCompress: false,

web/src/OrganizationEditPage.js

@@ -561,6 +561,16 @@ class OrganizationEditPage extends React.Component {
             }} />
           </Col>
         </Row>
+        <Row style={{marginTop: "20px"}} >
+          <Col style={{marginTop: "5px"}} span={(Setting.isMobile()) ? 19 : 2}>
+            {Setting.getLabel(i18next.t("application:Disable signin"), i18next.t("application:Disable signin - Tooltip"))} :
+          </Col>
+          <Col span={1} >
+            <Switch checked={this.state.organization.disableSignin} onChange={checked => {
+              this.updateOrganizationField("disableSignin", checked);
+            }} />
+          </Col>
+        </Row>
         <Row style={{marginTop: "20px"}} >
           <Col style={{marginTop: "5px"}} span={(Setting.isMobile()) ? 22 : 2}>
             {Setting.getLabel(i18next.t("organization:Navbar items"), i18next.t("organization:Navbar items - Tooltip"))} :

web/src/OrganizationListPage.js

@@ -49,6 +49,7 @@ class OrganizationListPage extends BaseListPage {
       enableSoftDeletion: false,
       isProfilePublic: true,
       enableTour: true,
+      disableSignin: false,
       mfaRememberInHours: DefaultMfaRememberInHours,
       accountItems: [
         {name: "Organization", visible: true, viewRule: "Public", modifyRule: "Admin"},

web/src/WebhookEditPage.js

@@ -34,6 +34,7 @@ const applicationTemplate = {
   logo: `${Setting.StaticBaseUrl}/img/casdoor-logo_1185x256.png`,
   enablePassword: true,
   enableSignUp: true,
+  disableSignin: false,
   enableSigninSession: false,
   enableCodeSignin: false,
   enableSamlCompress: false,

web/src/locales/ar/data.json

@@ -40,6 +40,8 @@
     "Custom CSS Mobile": "CSS مخصص للجوال",
     "Custom CSS Mobile - Edit": "تعديل CSS مخصص للجوال",
     "Custom CSS Mobile - Tooltip": "CSS مخصص للجوال - تلميح",
+    "Disable signin": "Disable signin",
+    "Disable signin - Tooltip": "Disable signin - Tooltip",
     "Dynamic": "ديناميكي",
     "Edit Application": "تحرير التطبيق",
     "Enable Email linking": "تمكين ربط البريد الإلكتروني",

web/src/locales/cs/data.json

@@ -40,6 +40,8 @@
     "Custom CSS Mobile": "Vlastní CSS pro mobil",
     "Custom CSS Mobile - Edit": "Vlastní CSS pro mobil - úprava",
     "Custom CSS Mobile - Tooltip": "Vlastní CSS pro mobil - popisek",
+    "Disable signin": "Disable signin",
+    "Disable signin - Tooltip": "Disable signin - Tooltip",
     "Dynamic": "Dynamický",
     "Edit Application": "Upravit aplikaci",
     "Enable Email linking": "Povolit propojení e-mailu",

web/src/locales/de/data.json

@@ -40,6 +40,8 @@
     "Custom CSS Mobile": "Benutzerdefiniertes CSS mobil",
     "Custom CSS Mobile - Edit": "Benutzerdefiniertes CSS mobil – Bearbeiten",
     "Custom CSS Mobile - Tooltip": "Benutzerdefiniertes CSS mobil – Tooltip",
+    "Disable signin": "Disable signin",
+    "Disable signin - Tooltip": "Disable signin - Tooltip",
     "Dynamic": "Dynamisch",
     "Edit Application": "Bearbeitungsanwendung",
     "Enable Email linking": "E-Mail-Verknüpfung aktivieren",

web/src/locales/en/data.json

@@ -40,6 +40,8 @@
     "Custom CSS Mobile": "Custom CSS Mobile",
     "Custom CSS Mobile - Edit": "Custom CSS Mobile - Edit",
     "Custom CSS Mobile - Tooltip": "Custom CSS Mobile - Tooltip",
+    "Disable signin": "Disable signin",
+    "Disable signin - Tooltip": "Disable signin - Tooltip",
     "Dynamic": "Dynamic",
     "Edit Application": "Edit Application",
     "Enable Email linking": "Enable Email linking",

web/src/locales/es/data.json

@@ -40,6 +40,8 @@
     "Custom CSS Mobile": "CSS personalizado para móvil",
     "Custom CSS Mobile - Edit": "CSS personalizado para móvil - Editar",
     "Custom CSS Mobile - Tooltip": "CSS personalizado para móvil - Información adicional",
+    "Disable signin": "Disable signin",
+    "Disable signin - Tooltip": "Disable signin - Tooltip",
     "Dynamic": "Dinámico",
     "Edit Application": "Editar solicitud",
     "Enable Email linking": "Habilitar enlace de correo electrónico",

web/src/locales/fa/data.json

@@ -40,6 +40,8 @@
     "Custom CSS Mobile": "CSS سفارشی موبایل",
     "Custom CSS Mobile - Edit": "ویرایش CSS سفارشی موبایل",
     "Custom CSS Mobile - Tooltip": "CSS سفارشی برای موبایل",
+    "Disable signin": "Disable signin",
+    "Disable signin - Tooltip": "Disable signin - Tooltip",
     "Dynamic": "پویا",
     "Edit Application": "ویرایش برنامه",
     "Enable Email linking": "فعال‌سازی اتصال ایمیل",

web/src/locales/fi/data.json

@@ -40,6 +40,8 @@
     "Custom CSS Mobile": "Mukautettu CSS - matkaviestit",
     "Custom CSS Mobile - Edit": "Muokkaa mukautettua CSS:ää - matkaviestit",
     "Custom CSS Mobile - Tooltip": "Mukautettu CSS - matkaviestit - työkalupala",
+    "Disable signin": "Disable signin",
+    "Disable signin - Tooltip": "Disable signin - Tooltip",
     "Dynamic": "Dynaaminen",
     "Edit Application": "Muokkaa sovellusta",
     "Enable Email linking": "Ota sähköpostiinkkoutuminen käyttöön",

web/src/locales/fr/data.json

@@ -40,6 +40,8 @@
     "Custom CSS Mobile": "CSS personnalisé mobile",
     "Custom CSS Mobile - Edit": "CSS personnalisé mobile - Modifier",
     "Custom CSS Mobile - Tooltip": "CSS personnalisé mobile - Infobulle",
+    "Disable signin": "Disable signin",
+    "Disable signin - Tooltip": "Disable signin - Tooltip",
     "Dynamic": "Dynamique",
     "Edit Application": "Modifier l'application",
     "Enable Email linking": "Autoriser à lier l'e-mail",

web/src/locales/he/data.json

@@ -40,6 +40,8 @@
     "Custom CSS Mobile": "CSS מותאם אישית לנייד",
     "Custom CSS Mobile - Edit": "ערוך CSS מותאם אישית לנייד",
     "Custom CSS Mobile - Tooltip": "CSS מותאם אישית לנייד - תיאור",
+    "Disable signin": "Disable signin",
+    "Disable signin - Tooltip": "Disable signin - Tooltip",
     "Dynamic": "דינמי",
     "Edit Application": "ערוך יישום",
     "Enable Email linking": "אפשר קישור דוא\"ל",

web/src/locales/id/data.json

@@ -40,6 +40,8 @@
     "Custom CSS Mobile": "CSS Seluler Khusus",
     "Custom CSS Mobile - Edit": "CSS Seluler Khusus - Edit",
     "Custom CSS Mobile - Tooltip": "CSS Seluler Khusus - Tooltip",
+    "Disable signin": "Disable signin",
+    "Disable signin - Tooltip": "Disable signin - Tooltip",
     "Dynamic": "Dinamis",
     "Edit Application": "Mengedit aplikasi",
     "Enable Email linking": "Aktifkan pengaitan email",

web/src/locales/it/data.json

@@ -40,6 +40,8 @@
     "Custom CSS Mobile": "CSS personalizzato mobile",
     "Custom CSS Mobile - Edit": "CSS personalizzato mobile - Modifica",
     "Custom CSS Mobile - Tooltip": "CSS personalizzato mobile - Tooltip",
+    "Disable signin": "Disable signin",
+    "Disable signin - Tooltip": "Disable signin - Tooltip",
     "Dynamic": "Dinamico",
     "Edit Application": "Modifica Applicazione",
     "Enable Email linking": "Abilita collegamento Email",

web/src/locales/ja/data.json

@@ -40,6 +40,8 @@
     "Custom CSS Mobile": "カスタムCSS（モバイル）",
     "Custom CSS Mobile - Edit": "カスタムCSS（モバイル）- 編集",
     "Custom CSS Mobile - Tooltip": "カスタムCSS（モバイル）- ツールチップ",
+    "Disable signin": "Disable signin",
+    "Disable signin - Tooltip": "Disable signin - Tooltip",
     "Dynamic": "動的",
     "Edit Application": "アプリケーションを編集する",
     "Enable Email linking": "イーメールリンクの有効化",

web/src/locales/kk/data.json

@@ -40,6 +40,8 @@
     "Custom CSS Mobile": "Теңшеу CSS (мобильді)",
     "Custom CSS Mobile - Edit": "Теңшеу CSS (мобильді) - Өңдеу",
     "Custom CSS Mobile - Tooltip": "Теңшеу CSS (мобильді) - Қысқаша түсінік",
+    "Disable signin": "Disable signin",
+    "Disable signin - Tooltip": "Disable signin - Tooltip",
     "Dynamic": "Динамикалық",
     "Edit Application": "Қолданбаны өңдеу",
     "Enable Email linking": "Email байланысын қосу",

web/src/locales/ko/data.json

@@ -40,6 +40,8 @@
     "Custom CSS Mobile": "모바일 사용자 정의 CSS",
     "Custom CSS Mobile - Edit": "모바일 사용자 정의 CSS - 편집",
     "Custom CSS Mobile - Tooltip": "모바일 사용자 정의 CSS - 툴팁",
+    "Disable signin": "Disable signin",
+    "Disable signin - Tooltip": "Disable signin - Tooltip",
     "Dynamic": "동적",
     "Edit Application": "앱 편집하기",
     "Enable Email linking": "이메일 링크 사용 가능하도록 설정하기",

web/src/locales/ms/data.json

@@ -40,6 +40,8 @@
     "Custom CSS Mobile": "CSS Tersuai Mudah Alih",
     "Custom CSS Mobile - Edit": "CSS Tersuai Mudah Alih - Edit",
     "Custom CSS Mobile - Tooltip": "CSS Tersuai Mudah Alih - Tooltip",
+    "Disable signin": "Disable signin",
+    "Disable signin - Tooltip": "Disable signin - Tooltip",
     "Dynamic": "Dinamik",
     "Edit Application": "Edit Aplikasi",
     "Enable Email linking": "Dayakan pautan Emel",

web/src/locales/nl/data.json

@@ -40,6 +40,8 @@
     "Custom CSS Mobile": "Aangepaste CSS mobiel",
     "Custom CSS Mobile - Edit": "Aangepaste CSS mobiel - Bewerken",
     "Custom CSS Mobile - Tooltip": "Aangepaste CSS mobiel - Tooltip",
+    "Disable signin": "Disable signin",
+    "Disable signin - Tooltip": "Disable signin - Tooltip",
     "Dynamic": "Dynamisch",
     "Edit Application": "Applicatie bewerken",
     "Enable Email linking": "E-mailkoppeling inschakelen",

web/src/locales/pl/data.json

@@ -40,6 +40,8 @@
     "Custom CSS Mobile": "Niestandardowy CSS (wersja mobilna)",
     "Custom CSS Mobile - Edit": "Edycja niestandardowego CSS (wersja mobilna)",
     "Custom CSS Mobile - Tooltip": "Niestandardowy CSS (wersja mobilna) - Tooltip",
+    "Disable signin": "Disable signin",
+    "Disable signin - Tooltip": "Disable signin - Tooltip",
     "Dynamic": "Dynamiczny",
     "Edit Application": "Edytuj aplikację",
     "Enable Email linking": "Włącz łączenie e-maili",

web/src/locales/pt/data.json

@@ -40,6 +40,8 @@
     "Custom CSS Mobile": "CSS personalizado para dispositivos móveis",
     "Custom CSS Mobile - Edit": "Editar CSS personalizado para dispositivos móveis",
     "Custom CSS Mobile - Tooltip": "Dica: CSS personalizado para dispositivos móveis",
+    "Disable signin": "Disable signin",
+    "Disable signin - Tooltip": "Disable signin - Tooltip",
     "Dynamic": "Dinâmico",
     "Edit Application": "Editar Aplicação",
     "Enable Email linking": "Ativar vinculação de e-mail",

web/src/locales/ru/data.json

@@ -40,6 +40,8 @@
     "Custom CSS Mobile": "Пользовательский CSS (мобильный)",
     "Custom CSS Mobile - Edit": "Редактировать пользовательский CSS (мобильный)",
     "Custom CSS Mobile - Tooltip": "Подсказка: пользовательский CSS (мобильный)",
+    "Disable signin": "Disable signin",
+    "Disable signin - Tooltip": "Disable signin - Tooltip",
     "Dynamic": "Динамический",
     "Edit Application": "Изменить приложение",
     "Enable Email linking": "Включить связывание электронной почты",

web/src/locales/sk/data.json

@@ -40,6 +40,8 @@
     "Custom CSS Mobile": "Vlastný CSS pre mobilné zariadenia",
     "Custom CSS Mobile - Edit": "Vlastný CSS pre mobilné zariadenia - Upraviť",
     "Custom CSS Mobile - Tooltip": "Vlastný CSS pre mobilné zariadenia - Tooltip",
+    "Disable signin": "Disable signin",
+    "Disable signin - Tooltip": "Disable signin - Tooltip",
     "Dynamic": "Dynamické",
     "Edit Application": "Upraviť aplikáciu",
     "Enable Email linking": "Povoliť prepojenie e-mailu",

web/src/locales/sv/data.json

@@ -40,6 +40,8 @@
     "Custom CSS Mobile": "CSS Tersuai Mudah Alih",
     "Custom CSS Mobile - Edit": "CSS Tersuai Mudah Alih - Edit",
     "Custom CSS Mobile - Tooltip": "CSS Tersuai Mudah Alih - Tooltip",
+    "Disable signin": "Disable signin",
+    "Disable signin - Tooltip": "Disable signin - Tooltip",
     "Dynamic": "Dinamik",
     "Edit Application": "Edit Aplikasi",
     "Enable Email linking": "Dayakan pautan Emel",

web/src/locales/tr/data.json

@@ -40,6 +40,8 @@
     "Custom CSS Mobile": "Özel CSS (Mobil)",
     "Custom CSS Mobile - Edit": "Özel CSS (Mobil) - Düzenle",
     "Custom CSS Mobile - Tooltip": "Özel CSS (Mobil) - Araç ipucu",
+    "Disable signin": "Disable signin",
+    "Disable signin - Tooltip": "Disable signin - Tooltip",
     "Dynamic": "Dinamik",
     "Edit Application": "Uygulamayı düzenle",
     "Enable Email linking": "Eposta bağlantısı aktif",

web/src/locales/uk/data.json

@@ -40,6 +40,8 @@
     "Custom CSS Mobile": "Мобільний спеціальний CSS",
     "Custom CSS Mobile - Edit": "Редагувати мобільний спеціальний CSS",
     "Custom CSS Mobile - Tooltip": "Мобільний спеціальний CSS - Підказка",
+    "Disable signin": "Disable signin",
+    "Disable signin - Tooltip": "Disable signin - Tooltip",
     "Dynamic": "Динамічний",
     "Edit Application": "Редагувати програму",
     "Enable Email linking": "Дозволити зв’язок з Email",

web/src/locales/vi/data.json

@@ -40,6 +40,8 @@
     "Custom CSS Mobile": "CSS tùy chỉnh Mobile",
     "Custom CSS Mobile - Edit": "Chỉnh sửa CSS tùy chỉnh Mobile",
     "Custom CSS Mobile - Tooltip": "Gợi ý CSS tùy chỉnh Mobile",
+    "Disable signin": "Disable signin",
+    "Disable signin - Tooltip": "Disable signin - Tooltip",
     "Dynamic": "Động",
     "Edit Application": "Sửa ứng dụng",
     "Enable Email linking": "Cho phép liên kết Email",

web/src/locales/zh/data.json

@@ -40,6 +40,8 @@
     "Custom CSS Mobile": "表单CSS（移动端）",
     "Custom CSS Mobile - Edit": "编辑表单CSS（移动端）",
     "Custom CSS Mobile - Tooltip": "注册、登录、忘记密码等表单的CSS样式（如增加边框和阴影）（移动端）",
+    "Disable signin": "禁止登录",
+    "Disable signin - Tooltip": "禁止用户进行登录操作",
     "Dynamic": "动态开启",
     "Edit Application": "编辑应用",
     "Enable Email linking": "自动关联邮箱相同的账号",

web/src/table/ProviderTable.js

@@ -88,7 +88,10 @@ class ProviderTable extends React.Component {
                 }
               }} >
               {
-                Setting.getDeduplicatedArray(this.props.providers, table, "name").map((provider, index) => <Option key={index} value={provider.name}>{provider.name}</Option>)
+                Setting.getDeduplicatedArray(this.props.providers, table, "name").filter(provider => provider.category !== "Captcha" || !table.some(tableItem => {
+                  const existingProvider = Setting.getArrayItem(this.props.providers, "name", tableItem.name);
+                  return existingProvider && existingProvider.category === "Captcha";
+                })).map((provider, index) => <Option key={index} value={provider.name}>{provider.name}</Option>)
               }
             </Select>
           );