# Login, SSO and LDAP

> Configure how people sign in to FeatherPanel. Registration, captcha, OIDC and LDAP providers, Discord, e-mail codes, login page layout and admin SSO links.

Source: https://featherpanel.com/docs/admin/authentication/

This page is the admin checklist for sign-in. The protocol details (OIDC claim matching, LDAP binds, passkeys) are
in [OIDC, LDAP and passkeys](https://featherpanel.com/docs/api/sso).

## Registration

Settings under the Security category:

| Setting | Default | Effect |
| --- | --- | --- |
| `registration_enabled` | false | Lets visitors create their own account. |
| `registration_require_email_verification` | false | New users must verify their e-mail before logging in. Needs [SMTP](https://featherpanel.com/docs/admin/notifications-and-mail). |
| `registration_device_limit_enabled`, `registration_device_max_accounts` | false, 1 | Blocks sign-up when a browser already has that many accounts. |
| `email_domain_blocking_enabled` | false | Rejects addresses on the [blocked e-mail domains](https://featherpanel.com/docs/admin/security) list. |
| `abuseipdb_enabled` | false | Checks registrations against AbuseIPDB. |

## Captcha

Pick a provider with `captcha_provider`: Cloudflare Turnstile, hCaptcha, Google reCAPTCHA (v2 checkbox or v3 score
with a minimum score), Friendly Captcha or reForge Captcha. Enter the site key and secret key for that provider and
turn on `turnstile_enabled`. Despite the name, that key is the on switch for every provider. Login, LDAP login,
registration, password reset and two-factor forms then require a captcha.

## Sign-in methods

| Method | Id | Turn it on |
| --- | --- | --- |
| Username or e-mail and password | `local` | Always available unless hidden or blocked by `oidc_disable_local_login`. |
| Passkey | `passkey` | Users add passkeys on their [account page](https://featherpanel.com/docs/user/account). |
| LDAP / Active Directory | `ldap` | Add a provider in LDAP Providers. |
| E-mail code | `email_code` | `email_login_enabled`, with SMTP set up. |
| Discord | `discord` | `discord_oauth_enabled` plus client ID and secret. |
| OpenID Connect | `oidc` | Add a provider in OIDC Providers. |

Order them with `login_methods_order`, hide some with `login_hidden_methods` and choose the first one shown with
`login_default_method`. `require_two_fa_admins` makes admins set up two-factor authentication.

### OIDC providers

Admin area, OIDC Providers. Copy the callback URL shown at the top into your identity provider (Authentik, Keycloak,
Google and others), then add the provider: name, issuer URL, client ID and secret, scopes, e-mail and subject claims,
an optional group claim and required value, Auto-provision users and Require email verified.

### LDAP providers

Admin area, LDAP Providers, Add LDAP Provider:

- **Basic settings:** name, host, port, STARTTLS or LDAPS.
- **Bind:** a service account DN and password, or empty for an anonymous bind.
- **User search:** base DN and a filter with `{username}`, such as `(uid={username})` or, for Active Directory,
  `(sAMAccountName={username})`.
- **Attributes:** username, e-mail, first and last name.
- **Group access:** a group attribute (`memberOf`) and the group users must be in.
- **Provisioning:** create accounts on first login, sync e-mail and name on each login, and generate
  `username@panel-domain` when the directory has no e-mail.

Use Test Connection before you enable the provider.

## Login page look

The Auth Page settings change the layout without code: `auth_template` (split, centered, spotlight),
`auth_visual_preset`, headlines and taglines, `auth_secondary_layout` for other methods, the QR login panel
(`auth_show_qr_login`) and the footer style.

## Admin SSO links

On a user's edit page, the SSO action creates a single-use login token and copies a link of the form
`/auth/login?sso_token=...&redirect=...`. Opening it signs in as that user, then goes to `app_sso_redirect_path`.
The token expires after `app_sso_token_lifetime_minutes` (default 5, from 1 to 1440). It needs `admin.users.edit`.
The API is `POST /api/admin/users/{uuid}/sso-token`, with an optional `expires_in` in minutes.

## Frequently asked questions

### How do I stop people from signing up?

Leave registration_enabled set to false, which is the default. Only admins can then create accounts.

### How do I log in as a user to help them?

On the user's edit page, create an SSO link. It signs in as that user once and expires after app_sso_token_lifetime_minutes, 5 minutes by default.

### Can I restrict OIDC or LDAP logins to one group?

Yes. Set a group claim and required value on the OIDC provider, or a group attribute and required group on the LDAP provider.