diff --git a/frontend/src/App.vue b/frontend/src/App.vue
index c1dd884..c99d628 100644
--- a/frontend/src/App.vue
+++ b/frontend/src/App.vue
@@ -4,6 +4,7 @@
 
 <script setup lang="ts">
 import { onMounted } from 'vue'
+import { authApi } from '@/api/auth'
 import { getToken } from '@/utils/auth'
 import { redirectToSSO } from '@/utils/sso'
 import { useAuthStore } from '@/stores/auth'
@@ -20,7 +21,12 @@ onMounted(async () => {
     await authStore.refreshUser()
   } catch {
     authStore.clearAuth()
-    redirectToSSO()
+    const { data } = await authApi.getConfig()
+    if (data.sso_enabled) {
+      redirectToSSO()
+    } else {
+      window.location.assign('/login')
+    }
   }
 })
 </script>
diff --git a/frontend/src/api/auth.ts b/frontend/src/api/auth.ts
index 2317520..2b9cf17 100644
--- a/frontend/src/api/auth.ts
+++ b/frontend/src/api/auth.ts
@@ -3,7 +3,7 @@ import { getToken } from '@/utils/auth'
 
 export interface LoginRequest {
   username: string
-  password: string
+  password?: string
 }
 
 export interface UserInfo {
@@ -20,9 +20,48 @@ export interface LoginResponse {
   user: UserInfo
 }
 
+export interface AuthConfig {
+  sso_enabled: boolean
+}
+
 export const authApi = {
-  login(_data: LoginRequest): Promise<ApiResponse<LoginResponse>> {
-    return Promise.reject(new Error('password login is disabled'))
+  async getConfig(): Promise<ApiResponse<AuthConfig>> {
+    const response = await fetch('/auth/api/v1/config', {
+      headers: {
+        Accept: 'application/json',
+      },
+    })
+    const data = await response.json().catch(() => ({}))
+    if (!response.ok) {
+      throw new Error(data.error || `HTTP ${response.status}`)
+    }
+    return {
+      code: 0,
+      message: 'success',
+      data: {
+        sso_enabled: data.sso_enabled !== false,
+      },
+    }
+  },
+
+  async login(data: LoginRequest): Promise<ApiResponse<LoginResponse>> {
+    const response = await fetch('/auth/api/v1/login', {
+      method: 'POST',
+      headers: {
+        Accept: 'application/json',
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({ username: data.username }),
+    })
+    const result = await response.json().catch(() => ({}))
+    if (!response.ok) {
+      throw new Error(result.error || `HTTP ${response.status}`)
+    }
+    return {
+      code: 0,
+      message: 'success',
+      data: result,
+    }
   },
 
   async logout(): Promise<ApiResponse<null>> {
diff --git a/frontend/src/api/request.ts b/frontend/src/api/request.ts
index c7fa184..6a6f390 100644
--- a/frontend/src/api/request.ts
+++ b/frontend/src/api/request.ts
@@ -61,7 +61,16 @@ request.interceptors.response.use(
 
       if (status === 401) {
         removeToken()
-        redirectToSSO()
+        fetch('/auth/api/v1/config', { headers: { Accept: 'application/json' } })
+          .then((response) => response.json())
+          .then((data) => {
+            if (data.sso_enabled === false) {
+              window.location.assign('/login')
+            } else {
+              redirectToSSO()
+            }
+          })
+          .catch(() => redirectToSSO())
         ElMessage.error(backendMessage || '未授权，请重新登录')
       } else {
         const message = backendMessage || httpMessageMap[status] || `请求失败 (${status})`
diff --git a/frontend/src/router/index.ts b/frontend/src/router/index.ts
index cdb310f..e7e74ed 100644
--- a/frontend/src/router/index.ts
+++ b/frontend/src/router/index.ts
@@ -2,6 +2,7 @@ import { createRouter, createWebHistory } from 'vue-router'
 import { getToken } from '@/utils/auth'
 import { consumeSSOToken, redirectToSSO } from '@/utils/sso'
 import { useAuthStore } from '@/stores/auth'
+import { authApi } from '@/api/auth'
 
 const router = createRouter({
   history: createWebHistory(),
@@ -113,6 +114,10 @@ router.beforeEach(async (to) => {
   const token = authStore.token || getToken()
 
   if (to.meta.requiresAuth !== false && !token) {
+    const { data } = await authApi.getConfig()
+    if (!data.sso_enabled) {
+      return { path: '/login', query: to.fullPath === '/' ? {} : { redirect: to.fullPath } }
+    }
     redirectToSSO()
     return false
   }
@@ -121,6 +126,10 @@ router.beforeEach(async (to) => {
       await authStore.refreshUser()
     } catch {
       authStore.clearAuth()
+      const { data } = await authApi.getConfig()
+      if (!data.sso_enabled) {
+        return { path: '/login', query: to.fullPath === '/' ? {} : { redirect: to.fullPath } }
+      }
       redirectToSSO()
       return false
     }
diff --git a/frontend/src/views/auth/Login.vue b/frontend/src/views/auth/Login.vue
index 2d39019..bc08c66 100644
--- a/frontend/src/views/auth/Login.vue
+++ b/frontend/src/views/auth/Login.vue
@@ -9,32 +9,83 @@
         <h2>{{ title }}</h2>
         <p>{{ subtitle }}</p>
       </div>
-      <el-button type="primary" size="large" class="login-btn" @click="redirectToSSO('', '/')">
+      <div v-if="!ssoEnabled" class="local-login">
+        <el-input
+          v-model="username"
+          size="large"
+          placeholder="输入用户名"
+          @keyup.enter="handleLocalLogin"
+        />
+      </div>
+      <el-button type="primary" size="large" class="login-btn" :loading="loading" @click="handleLoginClick">
         {{ buttonText }}
       </el-button>
       <div class="login-footer">
-        <p>统一 LDAP 账号，同账号同密码</p>
+        <p>{{ footerText }}</p>
       </div>
     </div>
   </div>
 </template>
 
 <script setup lang="ts">
-import { computed, onMounted } from 'vue'
-import { useRoute } from 'vue-router'
+import { computed, onMounted, ref } from 'vue'
+import { useRoute, useRouter } from 'vue-router'
 import { redirectToSSO } from '@/utils/sso'
+import { useAuth } from '@/composables/useAuth'
+import { authApi } from '@/api/auth'
 
 const route = useRoute()
+const router = useRouter()
+const { login } = useAuth()
+const loading = ref(false)
+const username = ref('')
+const ssoEnabled = ref(true)
 const loggedOut = computed(() => route.query.logged_out === '1')
 const title = computed(() => loggedOut.value ? '已退出登录' : '统一基础设施平台')
-const subtitle = computed(() => loggedOut.value ? '本地登录态已清除' : '正在跳转到 SSO 登录')
-const buttonText = computed(() => loggedOut.value ? '重新登录' : '重新跳转')
+const subtitle = computed(() => {
+  if (!ssoEnabled.value) {
+    return '开发测试模式，输入用户名登录'
+  }
+  return loggedOut.value ? '本地登录态已清除' : '正在跳转到 SSO 登录'
+})
+const buttonText = computed(() => {
+  if (!ssoEnabled.value) {
+    return '登录'
+  }
+  return loggedOut.value ? '重新登录' : '重新跳转'
+})
+const footerText = computed(() => ssoEnabled.value ? '统一 LDAP 账号，同账号同密码' : 'SSO 已关闭，仅用于开发测试')
 
-onMounted(() => {
-  if (!loggedOut.value) {
+onMounted(async () => {
+  const { data } = await authApi.getConfig()
+  ssoEnabled.value = data.sso_enabled
+  if (ssoEnabled.value && !loggedOut.value) {
     redirectToSSO('', '/')
   }
 })
+
+const handleLoginClick = () => {
+  if (ssoEnabled.value) {
+    redirectToSSO('', '/')
+    return
+  }
+  handleLocalLogin()
+}
+
+const handleLocalLogin = async () => {
+  const value = username.value.trim()
+  if (!value) {
+    return
+  }
+  loading.value = true
+  try {
+    await login(value, '')
+    const redirect = typeof route.query.redirect === 'string' ? route.query.redirect : '/'
+    router.replace(redirect)
+  } finally {
+    loading.value = false
+  }
+}
 </script>
 
 <style scoped>
@@ -58,6 +109,10 @@ onMounted(() => {
   width: 100%;
 }
 
+.local-login {
+  margin-bottom: 14px;
+}
+
 .login-header {
   text-align: center;
   margin-bottom: 32px;
diff --git a/server/README.md b/server/README.md
index 4740566..8c280b8 100644
--- a/server/README.md
+++ b/server/README.md
@@ -68,19 +68,18 @@ mysql -uroot -p < docs/mysql-init.sql
 
 如果你使用的是 Docker Desktop、OrbStack、Colima 或容器里的 MySQL，应用访问 MySQL 时来源 IP 可能不是 `localhost`，而是类似 `192.168.65.1`。这时 MySQL 账号需要允许远程来源，`docs/mysql-init.sql` 已经包含 `'auth'@'%'`。
 
-如果要自动创建本地管理员账号，在 `.env` 里设置：
+默认启用 SSO：
 
 ```bash
-BOOTSTRAP_ADMIN_USERNAME=admin
-BOOTSTRAP_ADMIN_PASSWORD='your-password'
+SSO_ENABLED=true
 ```
 
-也可以直接使用环境变量：
+如果只是本地开发测试，可以关闭 SSO，前端会显示用户名登录框。后端只校验用户名非空；用户不存在时会自动创建本地用户，第一位用户会自动成为管理员：
 
 ```bash
 MYSQL_DSN='auth:auth@tcp(127.0.0.1:3306)/authserver?charset=utf8mb4&parseTime=True&loc=Local' \
 JWT_SECRET='change-this-secret' \
-BOOTSTRAP_ADMIN_PASSWORD='your-password' \
+SSO_ENABLED=false \
 go run ./cmd/server
 ```
 
@@ -151,7 +150,8 @@ bash scripts/restart-authserver.sh nginx
 |---|---|---|
 | `GET` | `/healthz` | 服务健康检查 |
 | `GET` | `/readyz` | 数据库连接检查 |
-| `POST` | `/api/v1/login` | 本地登录 |
+| `GET` | `/auth/api/v1/config` | 前端登录模式配置，返回 `sso_enabled` |
+| `POST` | `/auth/api/v1/login` | 本地开发测试登录，仅 `SSO_ENABLED=false` 时可用，只需用户名 |
 | `POST` | `/api/v1/login/ldap` | LDAP 登录预留 |
 | `GET` | `/api/v1/login/:provider` | SSO 跳转预留 |
 | `GET` | `/api/v1/login/:provider/callback` | SSO 回调预留 |
diff --git a/server/internal/config/config.go b/server/internal/config/config.go
index 9e4aa35..5a81eab 100644
--- a/server/internal/config/config.go
+++ b/server/internal/config/config.go
@@ -19,6 +19,7 @@ type Config struct {
 	PublicBaseURL            string
 	MySQLDSN                 string
 	AutoMigrate              bool
+	SSOEnabled               bool
 	JWTSecret                string
 	JWTIssuer                string
 	JWTTTLMinutes            int
@@ -68,6 +69,7 @@ func Load() Config {
 		PublicBaseURL:            publicBaseURL,
 		MySQLDSN:                 env("MYSQL_DSN", "auth:auth@tcp(127.0.0.1:3306)/authserver?charset=utf8mb4&parseTime=True&loc=Local"),
 		AutoMigrate:              envBool("AUTO_MIGRATE", true),
+		SSOEnabled:               envBool("SSO_ENABLED", true),
 		JWTSecret:                env("JWT_SECRET", "change-this-secret"),
 		JWTIssuer:                env("JWT_ISSUER", "authserver"),
 		JWTTTLMinutes:            envInt("JWT_TTL_MINUTES", 120),
diff --git a/server/internal/handler/auth.go b/server/internal/handler/auth.go
new file mode 100644
index 0000000..f92f0c1
--- /dev/null
+++ b/server/internal/handler/auth.go
@@ -0,0 +1,78 @@
+package handler
+
+import (
+	"errors"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/1024XEngineer/xinfra/server/internal/config"
+	"github.com/1024XEngineer/xinfra/server/internal/service"
+
+	"github.com/gin-gonic/gin"
+)
+
+type AuthHandler struct {
+	cfg  config.Config
+	auth *service.AuthService
+}
+
+type localLoginRequest struct {
+	Username string `json:"username"`
+}
+
+func NewAuthHandler(cfg config.Config, authService *service.AuthService) *AuthHandler {
+	return &AuthHandler{cfg: cfg, auth: authService}
+}
+
+func (h *AuthHandler) Config(c *gin.Context) {
+	c.JSON(http.StatusOK, gin.H{
+		"sso_enabled": h.cfg.SSOEnabled,
+	})
+}
+
+func (h *AuthHandler) LocalLogin(c *gin.Context) {
+	if h.cfg.SSOEnabled {
+		c.JSON(http.StatusForbidden, gin.H{"error": "local login is disabled when sso is enabled"})
+		return
+	}
+
+	var req localLoginRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	result, err := h.auth.LocalLogin(strings.TrimSpace(req.Username), c.ClientIP(), c.Request.UserAgent())
+	if err != nil {
+		switch {
+		case errors.Is(err, service.ErrInvalidCredential):
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		case errors.Is(err, service.ErrUserDisabled):
+			c.JSON(http.StatusForbidden, gin.H{"error": err.Error()})
+		default:
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		}
+		return
+	}
+
+	http.SetCookie(c.Writer, &http.Cookie{
+		Name:     AuthSessionCookieName,
+		Value:    result.Token,
+		Path:     "/auth/",
+		HttpOnly: true,
+		SameSite: http.SameSiteLaxMode,
+		MaxAge:   int(time.Until(result.ExpiresAt).Seconds()),
+	})
+	c.JSON(http.StatusOK, gin.H{
+		"token":      result.Token,
+		"expires_in": int(h.cfg.JWTTTL().Seconds()),
+		"user": gin.H{
+			"id":            result.User.ID,
+			"username":      result.User.Username,
+			"display_name":  result.User.DisplayName,
+			"email":         result.User.Email,
+			"business_line": "",
+			"is_admin":      result.User.IsAdmin,
+		},
+	})
+}
diff --git a/server/internal/router/router.go b/server/internal/router/router.go
index 7c7e687..d8effdf 100644
--- a/server/internal/router/router.go
+++ b/server/internal/router/router.go
@@ -72,6 +72,7 @@ func registerAuthServerRoutes(r *gin.Engine, deps Dependencies) {
 	wayneRoleBindingService := service.NewWayneRoleBindingService(deps.Config)
 
 	healthHandler := handler.NewHealthHandler(deps.DB)
+	authHandler := handler.NewAuthHandler(deps.Config, authService)
 	userHandler := handler.NewUserHandler()
 	wayenHandler := handler.NewWayenHandler(deps.DB, wayenService, auditService)
 	wayneRoleBindingHandler := handler.NewWayneRoleBindingHandler(wayneRoleBindingService, auditService)
@@ -89,6 +90,8 @@ func registerAuthServerRoutes(r *gin.Engine, deps Dependencies) {
 
 	v1 := r.Group("/auth/api/v1")
 	{
+		v1.GET("/config", authHandler.Config)
+		v1.POST("/login", authHandler.LocalLogin)
 		v1.GET("/login/internal-sso", samlHandler.Login)
 		v1.POST("/logout", samlHandler.Logout)
 		v1.GET("/saml/metadata", samlHandler.Metadata)
diff --git a/server/internal/service/auth.go b/server/internal/service/auth.go
index 28085d2..667ef26 100644
--- a/server/internal/service/auth.go
+++ b/server/internal/service/auth.go
@@ -39,6 +39,55 @@ func NewAuthService(cfg config.Config, db *gorm.DB, audit *AuditService) *AuthSe
 	return &AuthService{cfg: cfg, db: db, audit: audit}
 }
 
+func (s *AuthService) LocalLogin(username, clientIP, userAgent string) (*LoginResult, error) {
+	username = strings.TrimSpace(username)
+	if username == "" {
+		return nil, ErrInvalidCredential
+	}
+
+	var result *LoginResult
+	err := s.db.Transaction(func(tx *gorm.DB) error {
+		user, err := findOrCreateLocalUser(tx, username)
+		if err != nil {
+			return err
+		}
+		if user.Status != "active" {
+			s.audit.Write(AuditEntry{ActorUserID: user.ID, ActorUsername: user.Username, ClientIP: clientIP, UserAgent: userAgent, Action: "local.login.failed", Decision: "deny", Reason: "user_disabled"})
+			return ErrUserDisabled
+		}
+
+		token, tokenID, expiresAt, err := auth.Sign(s.cfg.JWTSecret, s.cfg.JWTIssuer, s.cfg.JWTTTL(), user.ID, user.Username, user.Email, user.IsAdmin)
+		if err != nil {
+			return err
+		}
+
+		now := time.Now()
+		if err := tx.Model(&model.User{}).Where("id = ?", user.ID).Update("last_login_at", now).Error; err != nil {
+			return err
+		}
+		if err := tx.Create(&model.AccessToken{
+			UserID:    user.ID,
+			TokenID:   tokenID,
+			TokenType: "access",
+			ClientIP:  clientIP,
+			UserAgent: userAgent,
+			ExpiresAt: expiresAt,
+		}).Error; err != nil {
+			return err
+		}
+
+		user.LastLoginAt = &now
+		result = &LoginResult{Token: token, TokenID: tokenID, ExpiresAt: expiresAt, User: user}
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	s.audit.Write(AuditEntry{ActorUserID: result.User.ID, ActorUsername: result.User.Username, ClientIP: clientIP, UserAgent: userAgent, Action: "local.login.success", Decision: "allow"})
+	return result, nil
+}
+
 func (s *AuthService) SAMLLogin(info *sso.SAMLDebugInfo, clientIP, userAgent string) (*LoginResult, error) {
 	subject := strings.TrimSpace(info.NameID)
 	email := firstSAMLAttribute(info.Attributes,
@@ -119,6 +168,41 @@ func (s *AuthService) SAMLLogin(info *sso.SAMLDebugInfo, clientIP, userAgent str
 	return result, nil
 }
 
+func findOrCreateLocalUser(tx *gorm.DB, username string) (model.User, error) {
+	email := ""
+	if looksLikeEmail(username) {
+		email = username
+	}
+
+	var user model.User
+	query := tx.Where("username = ? AND deleted_at IS NULL", username)
+	if email != "" {
+		query = query.Or("email = ? AND deleted_at IS NULL", email)
+	}
+	if err := query.First(&user).Error; err == nil {
+		return user, nil
+	} else if !errors.Is(err, gorm.ErrRecordNotFound) {
+		return model.User{}, err
+	}
+
+	var count int64
+	if err := tx.Model(&model.User{}).Where("deleted_at IS NULL").Count(&count).Error; err != nil {
+		return model.User{}, err
+	}
+	user = model.User{
+		Username:    username,
+		DisplayName: username,
+		Email:       email,
+		Source:      "local",
+		Status:      "active",
+		IsAdmin:     count == 0,
+	}
+	if err := tx.Create(&user).Error; err != nil {
+		return user, err
+	}
+	return user, nil
+}
+
 func findOrCreateSAMLUser(tx *gorm.DB, subject, email, displayName string) (model.User, error) {
 	username := samlUsername(email, subject)
 	if displayName == "" {