Login, SSO and LDAP
Configure how people sign in to FeatherPanel. Registration, captcha, OIDC and LDAP providers, Discord, e-mail codes, login page layout and admin SSO links.
On this page
This page is the admin checklist for sign-in. The protocol details (OIDC claim matching, LDAP binds, passkeys) are in OIDC, LDAP and passkeys.
Registration
Settings under the Security category:
| Setting | Default | Effect |
|---|---|---|
registration_enabled | false | Lets visitors create their own account. |
registration_require_email_verification | false | New users must verify their e-mail before logging in. Needs SMTP. |
registration_device_limit_enabled, registration_device_max_accounts | false, 1 | Blocks sign-up when a browser already has that many accounts. |
email_domain_blocking_enabled | false | Rejects addresses on the blocked e-mail domains list. |
abuseipdb_enabled | false | Checks registrations against AbuseIPDB. |
Captcha
Pick a provider with captcha_provider: Cloudflare Turnstile, hCaptcha, Google reCAPTCHA (v2 checkbox or v3 score
with a minimum score), Friendly Captcha or reForge Captcha. Enter the site key and secret key for that provider and
turn on turnstile_enabled. Despite the name, that key is the on switch for every provider. Login, LDAP login,
registration, password reset and two-factor forms then require a captcha.
Sign-in methods
| Method | Id | Turn it on |
|---|---|---|
| Username or e-mail and password | local | Always available unless hidden or blocked by oidc_disable_local_login. |
| Passkey | passkey | Users add passkeys on their account page. |
| LDAP / Active Directory | ldap | Add a provider in LDAP Providers. |
| E-mail code | email_code | email_login_enabled, with SMTP set up. |
| Discord | discord | discord_oauth_enabled plus client ID and secret. |
| OpenID Connect | oidc | Add a provider in OIDC Providers. |
Order them with login_methods_order, hide some with login_hidden_methods and choose the first one shown with
login_default_method. require_two_fa_admins makes admins set up two-factor authentication.
OIDC providers
Admin area, OIDC Providers. Copy the callback URL shown at the top into your identity provider (Authentik, Keycloak, Google and others), then add the provider: name, issuer URL, client ID and secret, scopes, e-mail and subject claims, an optional group claim and required value, Auto-provision users and Require email verified.
LDAP providers
Admin area, LDAP Providers, Add LDAP Provider:
- Basic settings: name, host, port, STARTTLS or LDAPS.
- Bind: a service account DN and password, or empty for an anonymous bind.
- User search: base DN and a filter with
{username}, such as(uid={username})or, for Active Directory,(sAMAccountName={username}). - Attributes: username, e-mail, first and last name.
- Group access: a group attribute (
memberOf) and the group users must be in. - Provisioning: create accounts on first login, sync e-mail and name on each login, and generate
username@panel-domainwhen the directory has no e-mail.
Use Test Connection before you enable the provider.
Login page look
The Auth Page settings change the layout without code: auth_template (split, centered, spotlight),
auth_visual_preset, headlines and taglines, auth_secondary_layout for other methods, the QR login panel
(auth_show_qr_login) and the footer style.
Admin SSO links
On a user’s edit page, the SSO action creates a single-use login token and copies a link of the form
/auth/login?sso_token=...&redirect=.... Opening it signs in as that user, then goes to app_sso_redirect_path.
The token expires after app_sso_token_lifetime_minutes (default 5, from 1 to 1440). It needs admin.users.edit.
The API is POST /api/admin/users/{uuid}/sso-token, with an optional expires_in in minutes.
Frequently asked questions
Leave registration_enabled set to false, which is the default. Only admins can then create accounts.
On the user's edit page, create an SSO link. It signs in as that user once and expires after app_sso_token_lifetime_minutes, 5 minutes by default.
Yes. Set a group claim and required value on the OIDC provider, or a group attribute and required group on the LDAP provider.