openwebwork · dlglin · Sep 15, 2026
diff --git a/conf/authen_LTI.conf.dist b/conf/authen_LTI.conf.dist
@@ -35,26 +35,12 @@ $debug_lti_grade_passback = 0;
 # Authentication settings
 ################################################################################################
 
-# This section enables LTI authentication.  If a course uses LTI 1.1 (see $LTIVersion below),
-# then the LTIAdvanced module will be used.  If a course uses LTI 1.3 (see $LTIVersion below),
-# the LTIAdvantage will be used.  If you know a site will not use one or the other, it can be
-# commented out. Failover to Basic_TheLastOption is necessary to authenticate with cookie keys.
-$authen{user_module} = [
-	'WeBWorK::Authen::LTIAdvantage',          # first try LTI 1.3
-	'WeBWorK::Authen::LTIAdvanced',           # next try LTI 1.1
-	'WeBWorK::Authen::Basic_TheLastOption'    # fallback authorization method
-];
-
-# List of authentication modules that may be used to enter the admin course.
-# This is used instead of $authen{user_module} when logging into the admin course.
-# Since the admin course provides overall power to add/delete courses, access
-# to this course should be protected by the best possible authentication you
-# have available to you.
-$authen{admin_module} = [
-	#'WeBWorK::Authen::LTIAdvantage',
-	#'WeBWorK::Authen::LTIAdvanced',
-	'WeBWorK::Authen::Basic_TheLastOption'
-];
+# After customizing this file for your LTI configuration, make sure to uncomment 
+# 'WeBWorK::Authen::LTIAdvantage' # for LTI 1.3
+# and/or
+# 'WeBWorK::Authen::LTIAdvanced' # for LTI 1.1
+# in the $authen{user_module} and/or $authen{admin_module} arrays in localOverrides.conf
+# in order to enable LTI authentication.
 
 # Include configurations.  You must uncomment at least one of the following. You may uncomment
 # both if the site may be using both LTI 1.1 and 1.3 in different courses. After uncommenting

diff --git a/conf/authen_ldap.conf.dist b/conf/authen_ldap.conf.dist
@@ -7,17 +7,10 @@
 # include("conf/authen_ldap.conf")
 ########################################################################################
 
-# Set LDAP as the authentication module to use.
-$authen{user_module} = 'WeBWorK::Authen::LDAP';
-
-# List of authentication modules that may be used to enter the admin course.
-# This is used instead of $authen{user_module} when logging into the admin course.
-# Since the admin course provides overall power to add/delete courses, access
-# to this course should be protected by the best possible authentication you
-# have available to you.
-$authen{admin_module} = [
-	'WeBWorK::Authen::LDAP'
-];
+# After customizing this file for your LDAP server, make sure to uncomment 
+# "WeBWorK::Authen::LDAP"
+# in the $authen{user_module} and/or $authen{admin_module} arrays in localOverrides.conf
+# in order to enable LDAP authentication.
 
 $authen{ldap_options} = {
 	# hosts to attempt to connect to, in order. For example:

diff --git a/conf/authen_saml2.conf.dist b/conf/authen_saml2.conf.dist
@@ -7,22 +7,10 @@
 # compatible with a wide range of SAML2 implementations, including Shibboleth.
 ################################################################################
 
-# Set Saml2 as the authentication module to use.
-# Comment out 'WeBWorK::Authen::Basic_TheLastOption' if bypassing Saml2
-# authentication is not allowed (see $saml2{bypass_query} below).
-$authen{user_module} = [
-	'WeBWorK::Authen::Saml2',
-	'WeBWorK::Authen::Basic_TheLastOption'
-];
-
-# List of authentication modules that may be used to enter the admin course.
-# This is used instead of $authen{user_module} when logging into the admin
-# course. Since the admin course provides overall power to add/delete courses,
-# access to this course should be protected by the best possible authentication
-# you have available to you.
-$authen{admin_module} = [
-	'WeBWorK::Authen::Saml2'
-];
+# After customizing this file for your SAML setup, make sure to uncomment 
+# 'WeBWorK::Authen::Saml2'
+# in the $authen{user_module} and/or $authen{admin_module} arrays in localOverrides.conf
+# in order to enable Saml2 authentication.
 
 # This URL query parameter can be added to the end of a course url to skip the
 # saml2 authentication module and go to the next one, for example,

diff --git a/conf/authen_shibboleth.conf.dist b/conf/authen_shibboleth.conf.dist
@@ -92,23 +92,10 @@
 
 ################################################################################
 
-# Set Shibboleth as the authentication module to use.
-# Comment out 'WeBWorK::Authen::Basic_TheLastOption' if bypassing Saml2
-# authentication via the bypass query option (see $shibboleth{bypass_query}
-# below) or the $shiboff option are both not allowed .
-$authen{user_module} = [
-	'WeBWorK::Authen::Shibboleth',
-	'WeBWorK::Authen::Basic_TheLastOption'
-];
-
-# List of authentication modules that may be used to enter the admin course.
-# This is used instead of $authen{user_module} when logging into the admin
-# course. Since the admin course provides overall power to add/delete courses,
-# access to this course should be protected by the best possible authentication
-# you have available to you.
-$authen{admin_module} = [
-	'WeBWorK::Authen::Shibboleth'
-];
+# After customizing this file for your Shibboleth setup, make sure to uncomment 
+# "WeBWorK::Authen::Shibboleth"
+# in the $authen{user_module} and/or $authen{admin_module} arrays in localOverrides.conf
+# in order to enable Shibboleth authentication.
 
 # Set $shiboff to 1 to disable Shibboleth authentication. Usually this is not
 # set here, but in the course.conf file for a course for which Shibboleth

diff --git a/conf/localOverrides.conf.dist b/conf/localOverrides.conf.dist
@@ -460,44 +460,9 @@ $mail{feedbackRecipients}    = [
 
 # Extra modules have been created to allow WeBWorK to use certain external
 # methods of authentication.
-
-# Select the authentication module to use for normal logins.
-# If this value is a string, then that authentication module will be used.  If
-# this value is a reference to an array of strings, then each string in the
-# array will be successively tested to see if it provides a module that can
-# handle the authentication request (by calling that module's
-# request_has_data_for_this_verification_module method).  The first module that
-# responds affirmatively will be used.
-#$authen{user_module} = [
-#	"WeBWorK::Authen::LDAP",
-#	"WeBWorK::Authen::Basic_TheLastOption"
-#];
-
-# Select the authentication module to use for proctor logins.
-# A string or a hash is accepted, as above.
-#$authen{proctor_module} = "WeBWorK::Authen::Proctor";
-
-# List of authentication modules that may be used to enter the admin course.
-# This is used instead of $authen{user_module} when logging into the admin course.
-# Since the admin course provides overall power to add/delete courses, access
-# to this course should be protected by the best possible authentication you
-# have available to you.  The current default is
-# WeBWorK::Authen::Basic_TheLastOption which is simple password based
-# authentication for a password locally stored in your WeBWorK server's
-# database.  On one hand, this is necessary as the initial setting, as it is the
-# only option available when a new server is being installed, on the other hand,
-# this option does not provide any capabilities to prevent dictionary attacks, etc.
-# At the very least you should use a very strong password with two factor authentication.
-# If you have the option to use a more secure authentication approach to the admin course
-# (one which you are confident cannot be spoofed) that is preferable.
-#
-# Note that if you include authentication module config files further down,
-# those may override the setting of $authen{admin_module} here.
-
-#$authen{admin_module} = [
-#	'WeBWorK::Authen::LDAP',
-#	'WeBWorK::Authen::Basic_TheLastOption'
-#];
+# To use any of these modules uncomment the relevant "include" line below,
+# and also the relevant lines in the $authen{user_module} (for regular 
+# courses) and/or $authen{admin_module} (for the admin course) farther below.
 
 ################################################################################
 # IMS LTI Authentication
@@ -510,7 +475,7 @@ $mail{feedbackRecipients}    = [
 # authen_LTI_1_1.conf, or authen_LTI_1_3.conf.dist to authen_LTI_1_3.conf
 # depending on which is enabled in authen_LTI.conf (both can be enabled).
 
-#include("conf/authen_LTI.conf");
+#include('conf/authen_LTI.conf');
 
 ################################################################################
 # LDAP Authentication
@@ -519,7 +484,7 @@ $mail{feedbackRecipients}    = [
 # You will have to copy the file authen_ldap.conf.dist to authen_ldap.conf,
 # and then edit that file to fill in the settings for your installation.
 
-#include("conf/authen_ldap.conf");
+#include('conf/authen_ldap.conf');
 
 ################################################################################
 # Shibboleth Authentication
@@ -529,7 +494,7 @@ $mail{feedbackRecipients}    = [
 # also need to copy the file authen_shibboleth.conf.dist to authen_shibboleth.conf,
 # and then edit that file to fill in the settings for your installation.
 
-#include("conf/authen_shibboleth.conf");
+#include('conf/authen_shibboleth.conf');
 
 ################################################################################
 # Saml2 Authentication
@@ -539,7 +504,54 @@ $mail{feedbackRecipients}    = [
 # authen_saml2.conf, and then edit that file to fill in the settings for your
 # installation.
 
-#include("conf/authen_saml2.conf");
+#include('conf/authen_saml2.conf');
+
+# Select the authentication module(s) to use for normal logins.
+# If this value is a string, then that authentication module will be used.  If
+# this value is a reference to an array of strings, then each string in the
+# array will be successively tested to see if it provides a module that can
+# handle the authentication request (by calling that module's
+# request_has_data_for_this_verification_module method).  The first module that
+# responds affirmatively will be used.
+# Note that both the LDAP and Basic_TheLastOption modules are 'terminal' in that
+# they do not have the capability to continue to another authentication module,
+# so if either of these are uncommented, then any addition modules listed after
+# them will never be reached.
+#$authen{user_module} = [
+#	'WeBWorK::Authen::LTIAdvantage',          # first try LTI 1.3
+#	'WeBWorK::Authen::LTIAdvanced',           # next try LTI 1.1
+#	'WeBWorK::Authen::Saml2',
+#	'WeBWorK::Authen::Shibboleth',
+#	'WeBWorK::Authen::LDAP',
+#	'WeBWorK::Authen::Basic_TheLastOption'.   # WeBWorK internal authentication
+#];
+
+# Select the authentication module to use for proctor logins.
+# A string or a hash is accepted, as above.
+#$authen{proctor_module} = "WeBWorK::Authen::Proctor";
+
+# List of authentication modules that may be used to enter the admin course.
+# This is used instead of $authen{user_module} when logging into the admin course.
+# Since the admin course provides overall power to add/delete courses, access
+# to this course should be protected by the best possible authentication you
+# have available to you.  The current default is
+# WeBWorK::Authen::Basic_TheLastOption which is simple password based
+# authentication for a password locally stored in your WeBWorK server's
+# database.  On one hand, this is necessary as the initial setting, as it is the
+# only option available when a new server is being installed, on the other hand,
+# this option does not provide any capabilities to prevent dictionary attacks, etc.
+# At the very least you should use a very strong password with two factor authentication.
+# If you have the option to use a more secure authentication approach to the admin course
+# (one which you are confident cannot be spoofed) that is preferable.
+#
+#$authen{admin_module} = [
+#	'WeBWorK::Authen::LTIAdvantage',          # first try LTI 1.3
+#	'WeBWorK::Authen::LTIAdvanced',           # next try LTI 1.1
+#	'WeBWorK::Authen::Saml2',
+#	'WeBWorK::Authen::Shibboleth',
+#	'WeBWorK::Authen::LDAP',
+#	'WeBWorK::Authen::Basic_TheLastOption'.   # WeBWorK internal authentication
+#];
 
 ################################################################################
 # Session Management