{% import "_macros.html" as macros %} Login - NanoIDP

NanoIDP

Identity Provider
{% if error %} {% endif %} {% if (two_step_login or totp_step) and login_username %}
Signing in as {{ login_username }}
{% endif %} {% if persona_mode %}
{% if saml_request %} {% endif %} {% if relay_state %} {% endif %} {{ macros.persona_picker(users, "Persona login - select a user to sign in.") }}
{% elif totp_step %} {# Declarative TOTP second factor (#348): a further phase after a successful password check, riding two_step's machinery. The "Change username" control is shared with the password step below the chain. #}
{% if saml_request %} {% endif %} {% if relay_state %} {% endif %} {{ macros.totp_code_fields(login_username, login_password) }}
{% elif two_step_login and not login_username %}
{% if saml_request %} {% endif %} {% if relay_state %} {% endif %}
{% if users %} {% endif %} {% elif two_step_login %}
{% if saml_request %} {% endif %} {% if relay_state %} {% endif %}
{% else %}
{% if saml_request %} {% endif %} {% if relay_state %} {% endif %}
{% if users %} {% endif %} {% endif %} {% if (two_step_login or totp_step) and login_username %} {# "Change username" for the password step and the TOTP step alike - one block, so the two screens cannot drift. SAML's inline login has no GET to link back to (the SAMLRequest is a POST body, not stored anywhere), so it resubmits the same hidden fields with no username instead - _sso_authenticate_inline already renders the blank username screen for a POST that carries none (#323 review round 2, before-merge 3). #} {% if saml_request %}
{% if relay_state %} {% endif %}
{% else %}
Change username
{% endif %} {% endif %} {% if management_secret_configured %}

Mutating actions on this instance require the management secret, separately from signing in above.

{% endif %}