Username + Password based Authentication

When using password-based authentication, you have to manually add users either via the UI or via kubectl.

UI

STEP 1

Create User

Loft UI - Create User

STEP 2

Send Invite Link To User (optional)

If you did not specify a password for the user in step 1, Loft will automatically generate an invite link with a one-time access token for this user. If you send these invite links to your users, they will be logged in and asked to change their password.

kubectl

Create file user.yaml:

apiVersion: management.loft.sh/v1
kind: User
metadata:
  name: john
spec:
  displayName: John Doe
  email: john@acme.tld
  username: john
  subject: john           # Kubernetes subject (use username if in doubt)
  passwordRef:            # Specify this to set the password for the user
    key: password
    secretName: john-password
    secretNamespace: loft

Create file password.yaml:

apiVersion: v1
kind: Secret
metadata:
  name: john-password
  namespace: loft
type: Opaque
data:
  password: INSERT_BASE64_ENCODED_SHA256_PASSWORD_HASH

Create the user using kubectl:

# IMPORTANT: Run these commands inside the cluster where Loft is running
kubectl apply -f password.yaml
kubectl apply -f user.yaml

Disable Password Auth

Authentication with username and password is enabled by default but you can also disable password-based authentication if you want to force users to use single sign-on (SSO).

To disable password-based authentication, navigate to Admin > Config add these two lines to your config:

auth:
  oidc: ...             # This is your SSO configuration (make sure this is working!)
  password:
    disabled: true      # Disable password-based authentication