Repository: privacyidea/privacyidea

Issue:
Option to logout on "Lock"
privacyIDEA: 2.18
priority: medium

Hey guys - great initiative on allowing to lock the privacyIDEA screen on 2.18. 
It does create a problem for us since most our users don't use static password but SSL/PKI credentials to access the system. So when the screen is locked, PKI users are prompted for a password that is not applicable to them and can't unlock.

It would be great to consider an option to "logout on lock" instead. 

Thoughts?


Discussion:
As always, If you agree with the idea we are happy to implement it and submit a pull request.
I thought you would say this. ;-)

I guess this goes into a webui policy.

* scope: webui
* action: timeout_action: lock|logout


Resolving patch:
diff --git a/privacyidea/api/lib/postpolicy.py b/privacyidea/api/lib/postpolicy.py
--- a/privacyidea/api/lib/postpolicy.py
+++ b/privacyidea/api/lib/postpolicy.py
@@ -65,6 +65,7 @@
 DEFAULT_LOGOUT_TIME = 120
 DEFAULT_PAGE_SIZE = 15
 DEFAULT_TOKENTYPE = "hotp"
+DEFAULT_TIMEOUT_ACTION = "lockscreeen"
 DEFAULT_POLICY_TEMPLATE_URL = "https://raw.githubusercontent.com/privacyidea/" \
                               "policy-templates/master/templates/"
 
@@ -503,6 +504,12 @@ def get_webui_settings(request, response):
             realm=realm,
             client=client
         )
+        timeout_action_pol = policy_object.get_policies(
+            action=ACTION.TIMEOUT_ACTION,
+            scope=SCOPE.WEBUI,
+            realm=realm,
+            client=client
+        )
         default_tokentype_pol = policy_object.get_action_values(
             action=ACTION.DEFAULT_TOKENTYPE,
             scope=SCOPE.WEBUI,
@@ -525,6 +532,10 @@ def get_webui_settings(request, response):
         if len(logout_time_pol) == 1:
             logout_time = int(logout_time_pol[0])
 
+        timeout_action = DEFAULT_TIMEOUT_ACTION
+        if len(timeout_action_pol) == 1:
+            timeout_action = timeout_action_pol[0]['action']['timeout_action']
+
         policy_template_url_pol = policy_object.get_action_values(
             action=ACTION.POLICYTEMPLATEURL,
             scope=SCOPE.WEBUI,
@@ -544,6 +555,7 @@ def get_webui_settings(request, response):
         content["result"]["value"]["token_wizard"] = token_wizard
         content["result"]["value"]["token_wizard_2nd"] = token_wizard_2nd
         content["result"]["value"]["search_on_enter"] = len(search_on_enter) > 0
+        content["result"]["value"]["timeout_action"] = timeout_action
         response.data = json.dumps(content)
     return response
 
diff --git a/privacyidea/lib/policy.py b/privacyidea/lib/policy.py
--- a/privacyidea/lib/policy.py
+++ b/privacyidea/lib/policy.py
@@ -291,6 +291,7 @@ class ACTION(object):
     ENROLLPIN = "enrollpin"
     MANAGESUBSCRIPTION = "managesubscription"
     SEARCH_ON_ENTER = "search_on_enter"
+    TIMEOUT_ACTION = "timeout_action"
 
 
 class GROUP(object):
@@ -346,6 +347,12 @@ class AUTOASSIGNVALUE(object):
     NONE = "any_pin"
 
 
+class TIMEOUT_ACTION(object):
+    __doc__ = """This is a list of actions values for idle users"""
+    LOGOUT = "logout"
+    LOCKSCREEN = 'lockscreen'
+
+
 class PolicyClass(object):
 
     """
@@ -1567,6 +1574,13 @@ def get_static_policy_definitions(scope=None):
                 'desc': _('When searching in the user list, the search will '
                           'only performed when pressing enter.')
             },
+            ACTION.TIMEOUT_ACTION: {
+                'type': 'str',
+                'desc': _('The action taken when a user is idle '
+                          'beyond the logout_time limit. '
+                          'Defaults to "lockscreen".'),
+                'value': [TIMEOUT_ACTION.LOGOUT, TIMEOUT_ACTION.LOCKSCREEN],
+            },
             ACTION.REMOTE_USER: {
                 'type': 'str',
                 'value': [REMOTE_USER.ACTIVE, REMOTE_USER.DISABLE],


Test patch: