Allow disabling LDAP form login while keeping HTTP Basic enabled

[jusabatier]

Context

LDAP authentication currently enables both HTTP Basic and form login.

This makes it difficult to keep LDAP Basic Auth available for technical clients while avoiding an extra LDAP login option for browser users.

Changes

This PR adds a new disableLdapFormLogin option under georchestra.gateway.security.

Default behavior is unchanged.

georchestra:
  gateway:
    security:
      disableLdapFormLogin: true
      ldap:
        default:
          enabled: true

When disableLdapFormLogin is set to true:

• LDAP HTTP Basic remains enabled;
• LDAP form login is not enabled;
• the login page no longer displays the LDAP form;
• when only one OAuth2/OIDC provider is configured, browser users can still be redirected directly to that provider.

Backward compatibility

The default value is false, so existing configurations keep the current behavior:

LDAP enabled -> HTTP Basic + form login

Testing note

I was able to validate the code-level behavior locally, but I have not yet been able to run a full deployment/integration test in real conditions.

I am currently away and will only be able to perform deployment-level testing next week. Feedback on the approach is welcome in the meantime.

[jusabatier]

Just tested it, and it works well.

With disableLdapFormLogin: true and extended LDAP enabled, LDAP form login is not displayed for browser users, while LDAP HTTP Basic authentication still works as expected from QGIS on a WMS GetCapabilities request.

[jusabatier]

Possible to merge, or something remain to fix ?