Task #1337 — Self-signup external-password-management parity (api/auth signup)

The self-sign-up BFF route (POST /api/auth/signup in api/auth/index.php) previously probed external password management with config_get('external_password_mgmt', false) — a key that is NOT defined anywhere in config.inc.php nor the DB config table. config_get() (lib/functions/common.php:681-705) unconditionally logged a WARNING-level event (config option not available: external_password_mgmt) on every signup POST, polluting the Event Viewer. Because the getter fell back to false, the $externalPwd branch was dead code and the server always expected a local password — even when the page hid the password fields based on the correctly-computed externalPasswordMgmt from loginPageConfig. The BFF and the page disagreed about auth semantics.

The fix

api/auth/index.php:269-272 now reads:

$externalPwd = (bool) tlUser::isPasswordMgtExternal();

tlUser::isPasswordMgtExternal() (lib/functions/tlUser.class.php:206-230) reads $tlCfg->authentication[method] + domain[method]['allowPasswordManagement'] — a key that IS defined — and returns whether the configured auth method manages passwords externally (LDAP/SSO). It never queries an undefined config key, so no WARNING is emitted. Same function used by the reset route (api/auth/index.php:328) and by legacy firstLogin.php:75.

Parity achieved

Concern	Legacy firstLogin.php	Modern api/auth signup
External-flag source	tlUser::isPasswordMgtExternal() (line 75)	tlUser::isPasswordMgtExternal() (line 272)
Pwd field visibility	tpl hides fields when external (firstLogin.tpl:53-65)	firstLogin.html:79-84 hides #pwdFields
No local password stored	setPassword() returns S_PWDMGTEXTERNAL (2)	skips local-password step
Audit event	audit_users_self_signup CREATE	same
Spurious WARNING	none	none (after fix)

Verification (measured)

• grep -rn "config_get('external_password_mgmt'" api/ lib/ gui/ → 0 hits.
• Live A/B: modern signup → user created + only audit_users_self_signup (log_level=16); legacy firstLogin.php → same audit, both zero log_level=2 (WARNING). events table clean (4 events, all AUDIT).
• Browser: signup → redirect login.html?note=first ("First login detected. Welcome!"); new user logs in.
• isPasswordMgtExternal() probe: false (DB), true (LDAP) — page and BFF flags agree.

Files

• api/auth/index.php (line 272) — committed via 70b7ff633 (Refs #1337/#1342)
• docs/Task-Issue-1337-Auth-Signup-ExternalPwd-Parity.md (repo docs mirror)
• CHANGELOG — feature-gap note (Refs #1337)
• tmp/TLU_Test_Cases.md — Suite 1337 (6/6 PASS)

Related

• Bug #1554 (filed during this run): modern login.html:228 success fallback index.php?caller=login is a relative URL → 404 under /gui/templates/auth/; legacy redirects to root index.php. Out of scope of #1337.

---

TestLink 2.0.1 · auth signup external-password-management parity · Refs #1337