Sign-in and identity
What is available
| Method | Status | Where credentials live |
|---|---|---|
| Email and password | Available | Your Postgres |
| Multi-factor authentication | Available, and required during onboarding | Your Postgres |
| Microsoft Entra ID | **In development, not supported at the moment ** |
Nothing outside your cluster is involved in sign-in. Accounts, password hashes and sessions are all in your own database.
Microsoft Entra ID is in development. No generic OIDC provider, no SAML and no LDAP integration exists either.
If single sign-on is a requirement for you, tell us which provider, because that shapes what ships first.
The first account
Registration is invite-only and invites need an existing member, so a fresh install seeds one account with a published password. Signing in, completing onboarding and changing that password is a required install step, not an optional one.
See First sign-in.
The published address decides whether sign-in works
The dashboard derives its sign-in base URL from the host you publish it on. If that does not match the address people actually type in the browser, every sign-in is rejected as an invalid origin.
Two rules:
- Use the address people type. Not an internal service name, not a load balancer's own hostname.
- If TLS terminates upstream of the ingress, set the scheme explicitly, because the chart cannot
infer it and guesses
httpwhile the browser is onhttps.
--set externalScheme=https
Leave that unset when TLS terminates at the ingress. See Publish the endpoints.
Sessions
The signing secret lives in g0s-db-ui, created with all the other database secrets in
Install step 6.
| Action | Effect on sessions |
|---|---|
Re-running make-db-secrets.sh | None. The existing signing secret is preserved deliberately |
| Rotating the signing secret | Every session ends and every outstanding invite link stops working |
| Upgrading | None |
Turning the dashboard off entirely
If your operators use the API only:
--set services.ui.enabled=false
The agent-facing APIs are unaffected. Note that agent API keys are issued through the dashboard, so turn it off only once you have the keys you need.
If it fails
| Symptom | Cause |
|---|---|
| Sign-in rejected as an invalid origin | The published host does not match the address typed, or the scheme is wrong. See above |
| Sessions drop after a re-run of the secret script | The signing secret changed. It should not; check whether the secret was deleted first |
| Every sign-in fails after an upgrade | Check that externalScheme and the host survived the upgrade. helm get values g0s -n gen0sec |