Skip to content

docs: access check config docs rework #1477

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
edibotopic merged 3 commits into from
Apr 21, 2026
+12 −4
Merged

docs: access check config docs rework #1477

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
235afdb
add brief explanation of check
edibotopic Apr 20, 2026
b8a1b54
clarify wording on access check config option
edibotopic Apr 20, 2026
a08ba08
link to relevant section in security overview
edibotopic Apr 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions docs/explanation/security.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,7 @@ Strong passwords are critical to prevent unauthorized access.
authd uses libpwquality to enforce password complexity requirements. See the
[Configure password quality](ref::config-pwquality) section for details.

(ref::force-auth-security)=
#### Force provider authentication

If the identity provider is reachable during login, authd verifies that the user
Expand Down
15 changes: 11 additions & 4 deletions docs/howto/configure-authd.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -244,25 +244,32 @@ client_secret = <CLIENT_SECRET>
:::::

(ref::config-force-provider-auth)=
## Force remote authentication with the identity provider
## Force remote access check with the identity provider

By default, remote authentication with the identity provider only happens if
Copy link
Copy Markdown
Contributor

@adombeck adombeck Apr 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shouldn't we also use the new (and better) terminology here?

Suggested change
By default, remote authentication with the identity provider only happens if
By default, a remote access check with the identity provider only happens if

Copy link
Copy Markdown
Member

@nooreldeenmansour nooreldeenmansour Apr 22, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed, I can add this to #1467

Copy link
Copy Markdown
Contributor

@adombeck adombeck Apr 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

#1467 is completely unrelated, let's do it in a separate PR please. I'd like @edibotopic's opinion on the change first though.

there is a working internet connection and the provider is reachable during
login.

If you want to force remote authentication, even when the provider is
unreachable, enable it as follows:
To ensure that user access permissions are always checked with the identity
provider during login, even when the provider is unreachable, enable the check
as follows:

```ini
[oidc]
...
force_access_check_with_provider = true
```

This check works by forcing a token refresh during login, which fails if the
user does not have the necessary permissions in the identity provider.

```{warning}
In some cases, this may prevent login, such as when there are network issues.
In some cases, forcing the access check may prevent login, such as when there are network issues.
```

Additional information on the forced access check is provided in the [security
overview](ref::force-auth-security).

(ref::config-extra-scopes)=

## Configure extra scopes
Expand Down
Loading