Howard Miller

What path did you enter?

But that's always an issue with any persistent login system. You have to trust the end user not to tick the "keep me logged in" box on a public computer. In fact, even getting them to log out is a big ask.

It occurs to me that we do exactly this... but we use SAML, so that relies on a completely external (and non-trivial) authentication provider. It may be another way to look at the problem, however.

I've never heard of such a thing. I suspect you are creating a new auth plugin.

Well... no... the web version does check but it doesn't necessarily help. It relies on the information supplied by the plugin author, which is not always up to date. For example, if you are running Moodle 4.5, you can only install plugins that advertise themselves as having a version for Moodle 4.5. That doesn't mean that the 4.4 version won't work. This is especially relevant during an upgrade as the web update will suddenly ignore half of your optional plugins as it thinks there are no longer compatible versions. The practical reality is that you have to go and try them for yourself.