Hey everyone was wondering if there is a way to create a user just for credential purposes on Authentik? The goal is to add users but not have them be able to access the web gui at all. Have been searching and either can’t find it or am too tired or too stupid to understand. Any help is appreciated!
#Basic auth login for Authentik
leaden solstice
zinc pivot
Hey everyone was wondering if there is a way to create a user just for credentia...
I think you'll want to go to Directory/Users in the admin interface, create a user and mark it as a service user. That user should be able to authenticate to use your services and gets access to a web-ui, only allowing the addition of MFA, editing basic account details and seeing your applications you have set up. While I couldn't find a way to hide applications from the user, you open the application settings, go to "Policy / Group / User Bindings" then "Bind existing policy", go to User or group, select the corresponding user or group, tick "Negate result" and then "Create". That way they cannot open the service. Not even via the url directly. This might not be exactly what you are looking for though.
zinc pivot
I think you'll want to go to Directory/Users in the admin interface, create a us...
There's also a way to invite users, that you'd want to also restrict in most cases. That's the documentation: https://goauthentik.io/docs/user-group-role/user/invitations
You can follow this guide.
https://youtu.be/R7TpUcYSffQ
What I have tried is adding a policy to an Application that allows only certain users or groups to access and view it and a policy that denies access for a specific user or group. That does actually hide the application, which didn't happen for me at first. So you can restrict users from accessing any applications in a similar way to the video, just maybe negating the result for a user or group, prohibiting access, if you don't need it to be accessible by only one group. Hope that helps.
hallow grail
Good afternoon. I am also interested in this question. How can I prevent some users from logging into the web interface at all? For example, users (sonar, ldap and other simple services). It turns out that all created users can log into the web interface.