From d8a83ac270fe51c83d9cdef9f027bb867c4082bd Mon Sep 17 00:00:00 2001
From: Rob Ireton <rob@ireton.org>
Date: Thu, 24 Sep 2026 13:35:33 -0400
Subject: [PATCH] Remove ChiAuthBackend; 5.0.0
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Every user_manager consumer (daedalus, email_service, monitor — all on chi-cetus)
signs CHI users in through header SSO, so the backend that let the local form accept UC
and CHI credentials authenticated no one in production. It was also the second of two
paths answering the same questions, which is how #8 happened.

The local form stays: it is how daedalus and monitor sign in during development, and
/admin/login/ is the documented way in for a local superuser. Both go through Django's
ModelBackend, which this does not touch.

Gone with the backend, since nothing else read them: CHI_AUTH_API_ACCESS_TOKEN,
CHI_AUTH_CHECK_SYSTEMS, CHI_AUTH_TIMEOUT, UC_PASSWORD_MANAGER_URL, the
ACCOUNT_LOOKUP_URL and allow_chi_auth_login context variables, the UC/CHI hints and
links in login.html, and the requests dependency.

New checks for the upgrade:
- E003: AUTHENTICATION_BACKENDS still lists ChiAuthBackend. That path is only imported
  at sign-in, so a missed one fails every login after a healthy-looking deploy; as a
  check Error it fails `migrate` instead.
- W009: one of the three removed settings is still set, and does nothing.

Fixes #9.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CLAUDE.md                                     |  17 ++-
 README.md                                     |  74 +++++-----
 pyproject.toml                                |   1 -
 tests/settings.py                             |   1 -
 tests/test_backends.py                        | 139 ------------------
 tests/test_settings_and_checks.py             |  74 ++++++----
 user_manager/__init__.py                      |   2 +-
 user_manager/authentication_backends.py       | 104 -------------
 user_manager/checks.py                        |  38 +++++
 user_manager/context_processors.py            |  10 --
 user_manager/custom_settings.py               |  21 +--
 user_manager/middleware.py                    |   4 +-
 .../templates/user_manager/login.html         |  11 --
 13 files changed, 141 insertions(+), 355 deletions(-)
 delete mode 100644 tests/test_backends.py
 delete mode 100644 user_manager/authentication_backends.py

diff --git a/CLAUDE.md b/CLAUDE.md
index fe250e7..c6c8dbb 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -30,10 +30,19 @@ nobody exercises are options nobody tests.
 
 ## Authentication
 
-**Two login paths, and they must agree.** `ChiAuthLoginMiddleware` (header SSO) and
-`ChiAuthBackend` (password) are separate code that answers the same questions — does this
-user exist, may they in, do we create them. Issue #8 was those two drifting apart for
-years. When you change one, check the other.
+**CHI Auth signs people in one way: header SSO.** `ChiAuthLoginMiddleware` is the only
+code that decides whether a CHI Auth user exists here, may come in, or gets created.
+Until 5.0.0 `ChiAuthBackend` answered the same questions on a password path, and issue #8
+was the two drifting apart for years. No deployment used the backend, so #9 deleted it
+rather than keep reconciling them. Don't bring a second path back without a consumer that
+needs it.
+
+**The local form stays, for local accounts.** With `CHI_AUTH_USE_MIDDLEWARE` off — the
+package default, and how daedalus and monitor run in development — `login_view` renders
+`login.html` and authenticates through Django's `ModelBackend`. `/admin/login/` uses the
+same backend, and it is the documented way in for a local superuser. `user_manager.E003`
+catches a consumer still listing the removed backend, because that fails at sign-in, not
+at startup.
 
 **Usernames match with `__iexact`, and the stored spelling is never rewritten.** The
 directory behind CHI Auth is case-insensitive and the `SSO-Username` header carries
diff --git a/README.md b/README.md
index b831f39..01e6f99 100644
--- a/README.md
+++ b/README.md
@@ -19,23 +19,21 @@ boundary is — so pick it first and read the matching section below.
 | what secures it | **the network** — see “Header based SSO” | Django’s own session and CSRF handling |
 | used by | every CHI deployment | development, and non-CHI deployments |
 
-Within local login, `AUTHENTICATION_BACKENDS` decides *which* credentials the form accepts:
-Django’s `ModelBackend` alone for local passwords only, plus `ChiAuthBackend` to accept UC
-or CHI credentials as well. `CHI_AUTH_CHECK_SYSTEMS` then narrows that further — set it to
-`"local"` to accept CHI accounts while leaving UC Active Directory out of it entirely.
+Local login accepts **local accounts only**, through Django’s own `ModelBackend`. UC and CHI
+credentials are CHI Auth’s to check, on its own page, under header SSO. Until 5.0.0 a
+`ChiAuthBackend` let the local form accept them too; no deployment used it (issue #9).
 
 Supports Django 6.0 and 6.1 on Python 3.12+.
 
-Projects using it: daedalus, ocr_importer, monitor, neurords, rap_subsystem, fcc_tracker,
-email_service, covidicus. Daedalus is the most recently updated and is the best worked
-example to copy from.
+Projects using it: daedalus, email_service and monitor, all deployed on chi-cetus.
+email_service is the best worked example to copy from.
 
 ## Setup
 
 Install from GitHub with pip
 
 ```shell
-pip install "user_manager @ git+https://github.com/Center-for-Health-Informatics/django_user_manager.git@v4.0.1"
+pip install "user_manager @ git+https://github.com/Center-for-Health-Informatics/django_user_manager.git@v5.0.0"
 ```
 
 Check the tag against the latest release — this snippet is hand-maintained and has been
@@ -43,7 +41,7 @@ stale before.
 
 or add to a `requirements.txt` file
 ```
-user_manager @ git+https://github.com/Center-for-Health-Informatics/django_user_manager.git@v4.0.1
+user_manager @ git+https://github.com/Center-for-Health-Informatics/django_user_manager.git@v5.0.0
 ```
 
 Add `user_manager` app to your installed apps
@@ -60,17 +58,9 @@ Set the user manager model as your User model
 AUTH_USER_MODEL = "user_manager.User"
 ```
 
-Select the authentication backends you want to use
-```python
-# select auth backends to use when authenticating inside the app for development
-# the following will first try local authentication, then try CHI Auth authentication
-# checking both CHI Accounts and UC AD Accounts. On successful CHI Auth authentication,
-# the local user will be created if they don’t exist yet.
-AUTHENTICATION_BACKENDS = [
-    "django.contrib.auth.backends.ModelBackend",
-    "user_manager.authentication_backends.ChiAuthBackend",
-]
-```
+Leave `AUTHENTICATION_BACKENDS` at Django’s default, `ModelBackend`. It is what the local
+form and `/admin/login/` authenticate against. Listing the removed
+`user_manager.authentication_backends.ChiAuthBackend` is `user_manager.E003`.
 
 Define an abstract user
 - `user_manager` uses this as the base to build its concrete `User` model, so this is where you add any custom fields or methods.
@@ -86,7 +76,7 @@ class AbstractCustomUser(AbstractUser):
         abstract = True
 ```
 
-Register the context processor, so the login page can see `SITE_TITLE`, `CONTACT_EMAIL` and the CHI Auth help links. Without this the login page still renders, but with those values blank.
+Register the context processor, so the login page can see `SITE_TITLE`, `CONTACT_EMAIL` and `ASSETS_URL`. Without this the login page still renders, but with those values blank.
 
 ```python
 TEMPLATES = [
@@ -119,21 +109,9 @@ environment itself, the same way it does for everything else it configures, so t
 # user_manager.W007.
 CHI_AUTH_URL = "/auth/"
 
-# you need to provide an access token if using CHI_Auth
-CHI_AUTH_API_ACCESS_TOKEN = "🤫"
-
-# Which CHI_AUTH systems do you want to use for authentication, in order?
-# ucad is UC Active Directory, local is CHI_AUTH credentials for non-UC users.
-# The order decides which one authenticates a password when an account exists in both,
-# not merely which is asked first. Set it to "local" to turn UC AD off altogether.
-CHI_AUTH_CHECK_SYSTEMS = 'ucad, local'
-
-# Provision a local account for someone CHI_AUTH authenticates but this app has never
-# seen? Applies to both login paths. Defaults True; set False for closed provisioning.
+# Provision a local account for someone CHI_AUTH signs in but this app has never seen?
+# Read by the header SSO middleware. Defaults True; set False for closed provisioning.
 CHI_AUTH_AUTOCREATE_LOCAL_USER = True
-
-# seconds to wait on any call out to CHI Auth before giving up and failing the login
-CHI_AUTH_TIMEOUT = 5
 ```
 
 Set login/logout paths. These are the same in both modes — under header SSO the login view
@@ -161,9 +139,6 @@ SITE_TITLE = "Center for Health Informatics"
 # who to email for help
 CONTACT_EMAIL = "combmichi@uc.edu"
 
-# where to change a UC password
-UC_PASSWORD_MANAGER_URL = "https://www.uc.edu/sspr"
-
 # base URL of the shared CHI asset library, trailing slash included — the sign-in
 # page links its stylesheet and favicon from here. Set it to "/assets/" where the
 # library is served from this same host, and the assets stop being cross-origin.
@@ -383,6 +358,29 @@ MIDDLEWARE = [..., "user_manager.middleware.InspectHeadersMiddleware"]
 SPECIAL_LOG_FOLDER = "/var/log/myproject/"
 ```
 
+## Upgrading from 4.0 to 5.0
+
+**`ChiAuthBackend` is gone** (#9). It let the local sign-in form accept UC and CHI
+credentials by calling CHI Auth’s `api/authenticate`. Every consumer signs CHI users in
+through header SSO instead, so in production it authenticated no one. The local form stays,
+for local accounts through `ModelBackend` — which is how development signs in, and what
+`/admin/login/` uses.
+
+In each consumer, in the same change as the pin bump:
+
+- **Delete `"user_manager.authentication_backends.ChiAuthBackend"` from
+  `AUTHENTICATION_BACKENDS`.** Left in, every sign-in fails importing it, so
+  `user_manager.E003` makes `manage.py check` — and `migrate` — fail instead. That stops the
+  deploy only where the entrypoint runs under `set -e`; email_service’s does not today, so
+  check it by hand there.
+- **Delete `CHI_AUTH_API_ACCESS_TOKEN`, `CHI_AUTH_CHECK_SYSTEMS` and `CHI_AUTH_TIMEOUT`**
+  from `settings.py`, `example.settings.env` and the deployed `settings.env`. Nothing reads
+  them now; `user_manager.W009` names any still set.
+- `UC_PASSWORD_MANAGER_URL` and the `ACCOUNT_LOOKUP_URL` / `allow_chi_auth_login` context
+  variables are gone with it. No consumer template used them.
+
+A consumer still on 3.2 takes the 4.0 notes below as well.
+
 ## Upgrading from 4.0.0 to 4.0.1
 
 - **The sign-in page no longer carries an inline `<style>`.** It came from the shipped
diff --git a/pyproject.toml b/pyproject.toml
index 077ef9b..ca9e762 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -36,7 +36,6 @@ dependencies = [
     # is one release of slack, not a version anyone runs. 5.2 was dropped in 4.0.0 —
     # it was never exercised by any deployment and kept the Python floor at 3.10.
     "Django>=6.0,<7",
-    "requests",
 ]
 
 [project.urls]
diff --git a/tests/settings.py b/tests/settings.py
index 3088750..421e6c1 100644
--- a/tests/settings.py
+++ b/tests/settings.py
@@ -35,7 +35,6 @@
 
 AUTHENTICATION_BACKENDS = [
     "django.contrib.auth.backends.ModelBackend",
-    "user_manager.authentication_backends.ChiAuthBackend",
 ]
 
 ROOT_URLCONF = "tests.urls"
diff --git a/tests/test_backends.py b/tests/test_backends.py
deleted file mode 100644
index af71a0f..0000000
--- a/tests/test_backends.py
+++ /dev/null
@@ -1,139 +0,0 @@
-from unittest import mock
-
-import requests
-from django.contrib.auth import authenticate, get_user_model
-from django.test import TestCase, override_settings
-
-from user_manager.authentication_backends import ChiAuthBackend
-
-User = get_user_model()
-
-REMOTE_USER = {
-    "username": "ada",
-    "email": "ada@example.com",
-    "first_name": "Ada",
-    "last_name": "Lovelace",
-}
-
-
-def fake_response(payload=None, status_code=200, json_error=False):
-    response = mock.Mock(status_code=status_code)
-    if json_error:
-        response.json.side_effect = ValueError("not json")
-    else:
-        response.json.return_value = payload
-    return response
-
-
-def patch_get(**kwargs):
-    return mock.patch("user_manager.authentication_backends.requests.get", **kwargs)
-
-
-class ChiAuthBackendTests(TestCase):
-    def setUp(self):
-        self.backend = ChiAuthBackend()
-
-    def test_no_credentials_makes_no_request(self):
-        with patch_get() as get:
-            self.assertIsNone(self.backend.authenticate(None, username="", password=""))
-        get.assert_not_called()
-
-    def test_existing_user_authenticates(self):
-        user = User.objects.create_user(username="ada")
-        with patch_get(return_value=fake_response({"authenticated": True})):
-            self.assertEqual(self.backend.authenticate(None, "ada", "pw"), user)
-
-    def test_wrong_password_is_rejected(self):
-        User.objects.create_user(username="ada")
-        with patch_get(return_value=fake_response({"authenticated": False})):
-            self.assertIsNone(self.backend.authenticate(None, "ada", "pw"))
-
-    def test_inactive_user_is_rejected_without_calling_chi_auth(self):
-        """Deactivating an account must lock it out even while the UC credentials work."""
-        User.objects.create_user(username="ada", is_active=False)
-        with patch_get(return_value=fake_response({"authenticated": True})) as get:
-            self.assertIsNone(self.backend.authenticate(None, "ada", "pw"))
-        get.assert_not_called()
-
-    @override_settings(CHI_AUTH_AUTOCREATE_LOCAL_USER=False)
-    def test_unknown_user_is_rejected_when_autocreate_is_off(self):
-        # explicit since 4.0.0, where the default flipped to True — see issue #8
-        with patch_get() as get:
-            self.assertIsNone(self.backend.authenticate(None, "ada", "pw"))
-        get.assert_not_called()
-
-    def test_the_username_is_matched_case_insensitively(self):
-        """Issue #3: an exact match would authenticate "Ada" against a case-insensitive
-        directory and then provision a second account beside the existing "ada".
-        """
-        user = User.objects.create_user(username="ada")
-        with patch_get(return_value=fake_response({"authenticated": True})):
-            self.assertEqual(self.backend.authenticate(None, "Ada", "pw"), user)
-        self.assertEqual(User.objects.count(), 1)
-
-    @override_settings(CHI_AUTH_AUTOCREATE_LOCAL_USER=True)
-    def test_unknown_user_is_created_when_autocreate_is_on(self):
-        payload = {"authenticated": True, "user": REMOTE_USER}
-        with patch_get(return_value=fake_response(payload)):
-            user = self.backend.authenticate(None, "ada", "pw")
-
-        self.assertIsNotNone(user)
-        self.assertEqual(user.email, "ada@example.com")
-        self.assertEqual(user.first_name, "Ada")
-        self.assertEqual(user.last_name, "Lovelace")
-        self.assertFalse(user.has_usable_password())
-
-    @override_settings(CHI_AUTH_AUTOCREATE_LOCAL_USER=True)
-    def test_autocreate_tolerates_a_response_with_no_user_details(self):
-        with patch_get(return_value=fake_response({"authenticated": True})):
-            user = self.backend.authenticate(None, "ada", "pw")
-        self.assertEqual(user.username, "ada")
-
-    def test_network_failure_is_a_failed_login_not_an_exception(self):
-        User.objects.create_user(username="ada")
-        with patch_get(side_effect=requests.Timeout("too slow")):
-            with self.assertLogs("user_manager.authentication_backends", "WARNING"):
-                self.assertIsNone(self.backend.authenticate(None, "ada", "pw"))
-
-    def test_non_json_response_is_a_failed_login_not_an_exception(self):
-        User.objects.create_user(username="ada")
-        with patch_get(return_value=fake_response(status_code=502, json_error=True)):
-            with self.assertLogs("user_manager.authentication_backends", "WARNING"):
-                self.assertIsNone(self.backend.authenticate(None, "ada", "pw"))
-
-    @override_settings(CHI_AUTH_TIMEOUT=1.5, CHI_AUTH_URL="https://auth.test/")
-    def test_request_uses_the_configured_timeout_and_url(self):
-        User.objects.create_user(username="ada")
-        with patch_get(return_value=fake_response({"authenticated": True})) as get:
-            self.backend.authenticate(None, "ada", "pw")
-
-        args, kwargs = get.call_args
-        self.assertEqual(args[0], "https://auth.test/api/authenticate")
-        self.assertEqual(kwargs["timeout"], 1.5)
-        self.assertEqual(kwargs["headers"]["x-password"], "pw")
-
-    def test_get_user_rejects_inactive_users(self):
-        user = User.objects.create_user(username="ada")
-        self.assertEqual(self.backend.get_user(user.pk), user)
-        User.objects.filter(pk=user.pk).update(is_active=False)
-        self.assertIsNone(self.backend.get_user(user.pk))
-        self.assertIsNone(self.backend.get_user(user.pk + 1000))
-
-
-class AuthenticateIntegrationTests(TestCase):
-    """django.contrib.auth.authenticate() walks AUTHENTICATION_BACKENDS, and tags the
-    returned user with the backend that succeeded — which is what login() then stores.
-    """
-
-    def test_backend_attribute_is_set_by_chi_auth(self):
-        User.objects.create_user(username="ada")
-        with patch_get(return_value=fake_response({"authenticated": True})):
-            user = authenticate(None, username="ada", password="pw")
-        self.assertEqual(user.backend, "user_manager.authentication_backends.ChiAuthBackend")
-
-    def test_model_backend_still_wins_for_local_passwords(self):
-        User.objects.create_user(username="ada", password="hunter2")
-        with patch_get() as get:
-            user = authenticate(None, username="ada", password="hunter2")
-        self.assertEqual(user.backend, "django.contrib.auth.backends.ModelBackend")
-        get.assert_not_called()
diff --git a/tests/test_settings_and_checks.py b/tests/test_settings_and_checks.py
index 181e5e4..dc62462 100644
--- a/tests/test_settings_and_checks.py
+++ b/tests/test_settings_and_checks.py
@@ -8,6 +8,7 @@
 from user_manager.checks import (
     check_chi_auth_middleware,
     check_migration_modules,
+    check_removed_in_5,
     check_username_case_collisions,
 )
 from user_manager.context_processors import settings_context_processor
@@ -22,13 +23,11 @@
 
 class GetSettingTests(SimpleTestCase):
     def test_default_is_used_when_nothing_is_configured(self):
-        # "ucad, local" since 4.0.0 — the order all four deployed consumers set, and it
-        # decides which directory authenticates a password, not just which is asked first
-        self.assertEqual(custom_settings.CHI_AUTH_CHECK_SYSTEMS, "ucad, local")
+        self.assertEqual(custom_settings.SITE_TITLE, "Center for Health Informatics")
 
-    @override_settings(CHI_AUTH_CHECK_SYSTEMS="local")
+    @override_settings(SITE_TITLE="Daedalus")
     def test_django_setting_wins(self):
-        self.assertEqual(custom_settings.CHI_AUTH_CHECK_SYSTEMS, "local")
+        self.assertEqual(custom_settings.SITE_TITLE, "Daedalus")
 
     def test_the_environment_is_not_a_configuration_surface(self):
         """settings.py is the only place a setting comes from, as of 4.0.0 (issue #17).
@@ -38,8 +37,8 @@ def test_the_environment_is_not_a_configuration_surface(self):
         latency for three services through a surface no repository documented.
         """
         for name, raw in [
-            ("CHI_AUTH_CHECK_SYSTEMS", "ucad"),
-            ("CHI_AUTH_TIMEOUT", "30"),
+            ("CHI_AUTH_URL", "https://elsewhere.example/auth/"),
+            ("CHI_AUTH_AUTOCREATE_LOCAL_USER", "False"),
             ("USER_MANAGER_ABSTRACT_USER_MODEL", "somewhere.else.Model"),
         ]:
             with self.subTest(name=name):
@@ -76,10 +75,6 @@ def test_autocreate_defaults_on(self):
         """
         self.assertIs(custom_settings.CHI_AUTH_AUTOCREATE_LOCAL_USER, True)
 
-    @override_settings(CHI_AUTH_TIMEOUT="2.5")
-    def test_timeout_is_cast_to_a_number(self):
-        self.assertEqual(custom_settings.CHI_AUTH_TIMEOUT, 2.5)
-
     @override_settings(CHI_AUTH_TRUSTED_PROXIES="10.0.0.1, 10.0.0.2")
     def test_trusted_proxies_are_split(self):
         self.assertEqual(custom_settings.CHI_AUTH_TRUSTED_PROXIES, ["10.0.0.1", "10.0.0.2"])
@@ -88,20 +83,19 @@ def test_unknown_setting_raises(self):
         with self.assertRaises(AttributeError):
             _ = custom_settings.NOT_A_SETTING
 
+    def test_settings_only_chi_auth_backend_read_are_gone(self):
+        """Removed with it in 5.0.0 (issue #9), rather than left resolvable and unread."""
+        for name in [
+            "CHI_AUTH_API_ACCESS_TOKEN",
+            "CHI_AUTH_CHECK_SYSTEMS",
+            "CHI_AUTH_TIMEOUT",
+            "UC_PASSWORD_MANAGER_URL",
+        ]:
+            with self.subTest(name=name), self.assertRaises(AttributeError):
+                getattr(custom_settings, name)
 
-class ContextProcessorTests(SimpleTestCase):
-    def test_chi_auth_links_are_shown_when_the_backend_is_installed(self):
-        context = settings_context_processor(None)
-        self.assertTrue(context["allow_chi_auth_login"])
-        # relative, because CHI_AUTH_URL is: the link has to stay on the host the user
-        # is already signed in to
-        self.assertEqual(context["ACCOUNT_LOOKUP_URL"], "/auth/account_lookup")
-
-    @override_settings(CHI_AUTH_URL="https://chi.uc.edu/auth/")
-    def test_account_lookup_url_still_honours_an_absolute_setting(self):
-        context = settings_context_processor(None)
-        self.assertEqual(context["ACCOUNT_LOOKUP_URL"], "https://chi.uc.edu/auth/account_lookup")
 
+class ContextProcessorTests(SimpleTestCase):
     def test_assets_url_is_exposed_to_the_sign_in_template(self):
         self.assertEqual(
             settings_context_processor(None)["ASSETS_URL"], "https://chi.uc.edu/assets/"
@@ -111,9 +105,37 @@ def test_assets_url_is_exposed_to_the_sign_in_template(self):
     def test_assets_url_can_be_overridden(self):
         self.assertEqual(settings_context_processor(None)["ASSETS_URL"], "/assets/")
 
-    @override_settings(AUTHENTICATION_BACKENDS=["django.contrib.auth.backends.ModelBackend"])
-    def test_chi_auth_links_are_hidden_otherwise(self):
-        self.assertFalse(settings_context_processor(None)["allow_chi_auth_login"])
+    def test_no_links_for_the_removed_password_path(self):
+        """The UC and CHI password links only made sense beside ChiAuthBackend. The form
+        is for local accounts now; CHI Auth users never see it (issue #9)."""
+        context = settings_context_processor(None)
+        for name in ["allow_chi_auth_login", "UC_PASSWORD_MANAGER_URL", "ACCOUNT_LOOKUP_URL"]:
+            with self.subTest(name=name):
+                self.assertNotIn(name, context)
+
+
+class RemovedIn5ChecksTests(SimpleTestCase):
+    def ids(self, **settings_kwargs):
+        with override_settings(**settings_kwargs):
+            return [message.id for message in check_removed_in_5(None)]
+
+    def test_silent_on_a_converted_project(self):
+        self.assertEqual(self.ids(), [])
+
+    def test_errors_while_the_backend_is_still_listed(self):
+        """An Error, not a Warning: the dotted path is only imported at sign-in, so a
+        missed one fails every login — /admin/login/ included — after a healthy deploy."""
+        backends = [
+            "django.contrib.auth.backends.ModelBackend",
+            "user_manager.authentication_backends.ChiAuthBackend",
+        ]
+        self.assertEqual(self.ids(AUTHENTICATION_BACKENDS=backends), ["user_manager.E003"])
+
+    def test_warns_about_settings_nothing_reads_any_more(self):
+        with override_settings(CHI_AUTH_CHECK_SYSTEMS="ucad, local", CHI_AUTH_TIMEOUT=5):
+            messages = check_removed_in_5(None)
+        self.assertEqual([m.id for m in messages], ["user_manager.W009"])
+        self.assertIn("CHI_AUTH_CHECK_SYSTEMS, CHI_AUTH_TIMEOUT", messages[0].msg)
 
 
 class ChecksTests(SimpleTestCase):
diff --git a/user_manager/__init__.py b/user_manager/__init__.py
index 76ad18b..ba7be38 100644
--- a/user_manager/__init__.py
+++ b/user_manager/__init__.py
@@ -1 +1 @@
-__version__ = "4.0.1"
+__version__ = "5.0.0"
diff --git a/user_manager/authentication_backends.py b/user_manager/authentication_backends.py
deleted file mode 100644
index 904380a..0000000
--- a/user_manager/authentication_backends.py
+++ /dev/null
@@ -1,104 +0,0 @@
-import logging
-
-import requests
-from django.contrib.auth import get_user_model
-from django.contrib.auth.backends import BaseBackend
-
-from . import custom_settings as settings
-
-logger = logging.getLogger(__name__)
-
-
-class ChiAuthBackend(BaseBackend):
-    """
-    Authenticates against UC’s AD using the CHI Auth API.
-
-    1. If user does not exist here already, they will not be created
-       (unless CHI_AUTH_AUTOCREATE_LOCAL_USER is on).
-    2. The api/authenticate call is just a proxy for UC’s LDAP system.
-       It only cares if the username/PW matches in LDAP, not how that user is
-       defined locally on the SSO site.
-    """
-
-    def authenticate(self, request, username=None, password=None, **kwargs):
-        if not username or not password:
-            return None
-        UserModel = get_user_model()
-        # __iexact: the directory behind CHI Auth is case-insensitive, so an exact match
-        # here would authenticate "JSmith" against CHI Auth and then provision a second
-        # local account alongside the existing "jsmith". See checks.py W008.
-        oUser = UserModel.objects.filter(username__iexact=username).first()
-
-        # if no user and we’re not autocreating users, can quit here
-        if oUser is None and not settings.CHI_AUTH_AUTOCREATE_LOCAL_USER:
-            return None
-        # a deactivated account stays locked out even when the remote credentials still work
-        if oUser is not None and not self.user_can_authenticate(oUser):
-            return None
-
-        response = self._call_api(username, password)
-        if not response or not response.get("authenticated"):
-            return None
-
-        # if user exists locally and they authenticated, we’re good
-        if oUser:
-            return oUser
-
-        # if we’re autocreating and we authenticated a user that doesn’t exist, create them
-        remote_user = response.get("user") or {}
-        return UserModel.objects.create_user(
-            # CHI Auth's own spelling of the username wins over what was typed at the form
-            username=remote_user.get("username", username),
-            email=remote_user.get("email", ""),
-            first_name=remote_user.get("first_name", ""),
-            last_name=remote_user.get("last_name", ""),
-        )
-
-    def _call_api(self, username, password):
-        """Ask CHI Auth whether these credentials are valid. Returns the decoded response,
-        or None if CHI Auth could not be reached or answered with something unusable —
-        either way the caller treats it as a failed login rather than raising.
-        """
-        payload = {
-            "username": username,
-            "systems": settings.CHI_AUTH_CHECK_SYSTEMS,
-        }
-        headers = {
-            "x-password": password,
-            "x-access-token": settings.CHI_AUTH_API_ACCESS_TOKEN,
-        }
-        try:
-            r = requests.get(
-                settings.CHI_AUTH_URL + "api/authenticate",
-                params=payload,
-                headers=headers,
-                timeout=settings.CHI_AUTH_TIMEOUT,
-            )
-        except requests.RequestException:
-            logger.warning("CHI Auth could not be reached", exc_info=True)
-            return None
-
-        try:
-            return r.json()
-        except ValueError:
-            logger.warning("CHI Auth returned a non-JSON response (HTTP %s)", r.status_code)
-            return None
-
-    # this is just a copy of the default
-    # get_user method from django.contrib.auth.backends.ModelBackend
-    # (BaseBackend.get_user is only a stub that returns None)
-    def get_user(self, user_id):
-        UserModel = get_user_model()
-        try:
-            user = UserModel._default_manager.get(pk=user_id)
-        except UserModel.DoesNotExist:
-            return None
-        return user if self.user_can_authenticate(user) else None
-
-    def user_can_authenticate(self, user):
-        """
-        Reject users with is_active=False. Custom user models that don’t have
-        that attribute are allowed.
-        """
-        is_active = getattr(user, "is_active", None)
-        return is_active or is_active is None
diff --git a/user_manager/checks.py b/user_manager/checks.py
index 39c724b..851f617 100644
--- a/user_manager/checks.py
+++ b/user_manager/checks.py
@@ -16,6 +16,9 @@
 AUTH_MIDDLEWARE = "django.contrib.auth.middleware.AuthenticationMiddleware"
 CHI_AUTH_MIDDLEWARE = "user_manager.middleware.ChiAuthLoginMiddleware"
 INSPECT_MIDDLEWARE = "user_manager.middleware.InspectHeadersMiddleware"
+REMOVED_BACKEND = "user_manager.authentication_backends.ChiAuthBackend"
+# read only by ChiAuthBackend's call to CHI Auth's api/authenticate, removed in 5.0.0
+REMOVED_SETTINGS = ["CHI_AUTH_API_ACCESS_TOKEN", "CHI_AUTH_CHECK_SYSTEMS", "CHI_AUTH_TIMEOUT"]
 
 
 @register()
@@ -40,6 +43,41 @@ def check_migration_modules(app_configs, **kwargs):
     ]
 
 
+@register()
+def check_removed_in_5(app_configs, **kwargs):
+    """ChiAuthBackend is gone (issue #9): every consumer signs in through header SSO, and
+    the local form authenticates with Django's own ModelBackend.
+
+    Left in AUTHENTICATION_BACKENDS, the dotted path is only imported when someone signs in
+    — so every sign-in, /admin/login/ included, would fail with an ImportError long after
+    the deploy looked healthy. An Error here fails `migrate` instead, and with it the
+    deploy of any entrypoint running under `set -e`.
+    """
+    messages = []
+    if REMOVED_BACKEND in getattr(settings, "AUTHENTICATION_BACKENDS", []):
+        messages.append(
+            Error(
+                f"{REMOVED_BACKEND} was removed in user_manager 5.0.0, but "
+                f"AUTHENTICATION_BACKENDS still lists it. Every sign-in would fail importing it.",
+                hint="Delete it from AUTHENTICATION_BACKENDS. CHI Auth users arrive through "
+                "ChiAuthLoginMiddleware; the local form uses ModelBackend.",
+                id="user_manager.E003",
+            )
+        )
+    leftover = [name for name in REMOVED_SETTINGS if hasattr(settings, name)]
+    if leftover:
+        messages.append(
+            Warning(
+                f"Set, but read by nothing since user_manager 5.0.0 removed "
+                f"ChiAuthBackend: {', '.join(leftover)}.",
+                hint="Delete them from settings.py and from the deployment's settings.env, "
+                "so nothing appears configurable that is not.",
+                id="user_manager.W009",
+            )
+        )
+    return messages
+
+
 @register("security")
 def check_chi_auth_middleware(app_configs, **kwargs):
     errors = []
diff --git a/user_manager/context_processors.py b/user_manager/context_processors.py
index 5dab39c..b4efb6f 100644
--- a/user_manager/context_processors.py
+++ b/user_manager/context_processors.py
@@ -1,23 +1,13 @@
-from django.conf import settings
-
 from . import custom_settings
 
 
 def settings_context_processor(request):
-    # determine if CHI Auth is being used
-    allow_chi_auth_login = "user_manager.authentication_backends.ChiAuthBackend" in getattr(
-        settings, "AUTHENTICATION_BACKENDS", []
-    )
-
     my_dict = {
         "LOGIN_URL_FOR_LINK": custom_settings.LOGIN_URL_FOR_LINK,
         "LOGOUT_URL_FOR_LINK": custom_settings.LOGOUT_URL_FOR_LINK,
-        "UC_PASSWORD_MANAGER_URL": custom_settings.UC_PASSWORD_MANAGER_URL,
-        "ACCOUNT_LOOKUP_URL": f"{custom_settings.CHI_AUTH_URL}account_lookup",
         "CONTACT_EMAIL": custom_settings.CONTACT_EMAIL,
         "SITE_TITLE": custom_settings.SITE_TITLE,
         "ASSETS_URL": custom_settings.ASSETS_URL,
-        "allow_chi_auth_login": allow_chi_auth_login,
     }
 
     return my_dict
diff --git a/user_manager/custom_settings.py b/user_manager/custom_settings.py
index f396f3c..0361dd3 100644
--- a/user_manager/custom_settings.py
+++ b/user_manager/custom_settings.py
@@ -50,29 +50,16 @@ def _to_bool(value):
     # not span domains: the cookie and the SSO-* headers are per-domain. See checks.py
     # W007, which warns when this names a host.
     "CHI_AUTH_URL": "/auth/",
-    # you need to provide an access token if using CHI_Auth
-    "CHI_AUTH_API_ACCESS_TOKEN": "",
-    # seconds to wait on any call out to CHI Auth before giving up
-    "CHI_AUTH_TIMEOUT": 5,
     # Provision a local account for a user CHI Auth authenticates but this app has never
-    # seen? True on both login paths — the header SSO middleware and ChiAuthBackend.
+    # seen? Read by the header SSO middleware, the only path CHI Auth signs anyone in by
+    # since 5.0.0 removed ChiAuthBackend.
     #
     # Defaults True because that is what every deployment already does: before 4.0.0 the
     # middleware provisioned unconditionally and never consulted this setting (issue #8),
     # and header SSO is how everyone arrives. A default of False would have turned that
     # into "provisions no one" on the pin bump, silently, for every consumer that had
-    # never set it. A deployment that genuinely wants closed provisioning sets False and
-    # gets it on both paths.
+    # never set it. A deployment that genuinely wants closed provisioning sets False.
     "CHI_AUTH_AUTOCREATE_LOCAL_USER": True,
-    # what credentials should be accepted from CHI Auth? (comma separated string)
-    # local: user account in CHI Auth
-    # ucad: user account in UC Active Directory (only works if server is on UC network)
-    #
-    # The order is not merely which directory is asked first — it decides which one
-    # authenticates a password when an account exists in both. "ucad, local" is what all
-    # four deployed consumers set, so it is the default rather than something each of
-    # them restates.
-    "CHI_AUTH_CHECK_SYSTEMS": "ucad, local",
     # is header SSO in use — an upstream nginx authenticating against CHI Auth and passing
     # identity as SSO-* headers for ChiAuthLoginMiddleware to read? The project is what
     # installs the middleware; this is how the rest of the package knows it did. login_view
@@ -92,7 +79,6 @@ def _to_bool(value):
     "USER_MANAGER_ABSTRACT_USER_MODEL": "project.abstract_user_model.AbstractCustomUser",
     "SITE_TITLE": "Center for Health Informatics",
     "CONTACT_EMAIL": "combmichi@uc.edu",
-    "UC_PASSWORD_MANAGER_URL": "https://www.uc.edu/sspr",
     # Base URL of the shared CHI asset library, trailing slash included; the sign-in
     # template links its stylesheet and favicon from here. Absolute by default so an
     # existing consumer that says nothing keeps the styling it has, but overridable —
@@ -103,7 +89,6 @@ def _to_bool(value):
 
 # settings that need converting when a project supplies them as a string
 CASTS = {
-    "CHI_AUTH_TIMEOUT": float,
     "CHI_AUTH_AUTOCREATE_LOCAL_USER": _to_bool,
     "CHI_AUTH_USE_MIDDLEWARE": _to_bool,
     "CHI_AUTH_TRUSTED_PROXIES": _to_list,
diff --git a/user_manager/middleware.py b/user_manager/middleware.py
index 3033abe..0edf011 100644
--- a/user_manager/middleware.py
+++ b/user_manager/middleware.py
@@ -166,8 +166,8 @@ def get_or_create_user(request, username):
         oUser = User.objects.filter(username__iexact=username).first()
         if not oUser:
             if not custom_settings.CHI_AUTH_AUTOCREATE_LOCAL_USER:
-                # the same answer ChiAuthBackend gives on the password path; before 4.0.0
-                # this path provisioned regardless and the setting meant nothing here
+                # before 4.0.0 this path provisioned regardless and the setting meant
+                # nothing here
                 logger.warning(
                     "Refusing SSO login for unknown user %r: CHI_AUTH_AUTOCREATE_LOCAL_USER is off",
                     username,
diff --git a/user_manager/templates/user_manager/login.html b/user_manager/templates/user_manager/login.html
index 23f85a2..ad43fb9 100644
--- a/user_manager/templates/user_manager/login.html
+++ b/user_manager/templates/user_manager/login.html
@@ -21,13 +21,6 @@ <h1>Sign in to:<br><b>{{ SITE_TITLE }}</b></h1>
     <aside>{{ login_error }}</aside>
     {% endif %}
 
-    {% if allow_chi_auth_login %}
-    <ul>
-      <li><label>faculty, staff, students:</label> <span>sign in with your <b>UC</b> credentials</span></li>
-      <li><label>all others:</label> <span>sign in with your <b>CHI</b> credentials</span></li>
-    </ul>
-    {% endif %}
-
     <form action="" method="POST">
       {% csrf_token %}
       <input type="text" name="username" id="user-id" placeholder="Username" autofocus>
@@ -38,10 +31,6 @@ <h1>Sign in to:<br><b>{{ SITE_TITLE }}</b></h1>
     <footer>
       <h2>Need Help?</h2>
       <ul>
-        {% if allow_chi_auth_login %}
-        <li><a href="{{ UC_PASSWORD_MANAGER_URL }}" target="_blank">Forgot UC Central password</a></li>
-        <li><a href="{{ ACCOUNT_LOOKUP_URL }}">Create CHI account or reset password</a></li>
-        {% endif %}
         <li><a href="mailto:{{ CONTACT_EMAIL }}">Contact CHI</a></li>
       </ul>
     </footer>