Comment 1 for bug 1724743

Around line 391 of init.php we check if site is closed for upgrade/maintenance mode and if so we logout the user and redirect them to homepage if not doing install/upgrade.

Where we check $USER->is_logged_in() on line 396 we could also check if the auth instance is an external vs internal auth type and reply with the correct HTTP response and/or json object saying access is not available if external auth type before logging them out and redirecting to hompage.