Authentication

Configuration Fields

Example: Authentik Setup

Configure LogTide as an OAuth2/OIDC application in Authentik:

1. In Authentik, go to Applications > Applications and create a new application
2. Create an OAuth2/OIDC Provider with these settings:
   • Client type: Confidential
   • Client ID: (auto-generated or custom)
   • Client Secret: (auto-generated)
   • Redirect URIs: https://your-logtide.com/api/v1/auth/providers/authentik/callback
3. Note the OpenID Configuration Issuer URL from the provider overview
4. In LogTide Admin, add a new OIDC provider with these values

{
"issuerUrl": "https://auth.example.com/application/o/logtide/",
"clientId": "your-client-id",
"clientSecret": "your-client-secret",
"redirectUri": "https://logtide.example.com/api/v1/auth/providers/authentik/callback",
"scopes": ["openid", "email", "profile"]
}

Example: Keycloak Setup

1. In Keycloak Admin Console, create a new client in your realm
2. Set Client type: to "OpenID Connect"
3. Set Client authentication to "On" (confidential client)
4. Add Valid redirect URI: https://your-logtide.com/api/v1/auth/providers/keycloak/callback
5. Copy Client ID and Client Secret from the Credentials tab

{
"issuerUrl": "https://keycloak.example.com/realms/your-realm",
"clientId": "logtide",
"clientSecret": "your-client-secret"
}

Configuration Fields

Example: OpenLDAP Setup

{
"serverUrl": "ldap://ldap.example.com:389",
"bindDn": "cn=admin,dc=example,dc=com",
"bindPassword": "admin-password",
"searchBase": "ou=users,dc=example,dc=com",
"searchFilter": "(uid={{username}})",
"emailAttribute": "mail",
"nameAttribute": "cn"
}

Example: Active Directory Setup

{
"serverUrl": "ldaps://ad.example.com:636",
"bindDn": "CN=Service Account,OU=Service Accounts,DC=example,DC=com",
"bindPassword": "service-account-password",
"searchBase": "OU=Users,DC=example,DC=com",
"searchFilter": "(sAMAccountName={{username}})",
"emailAttribute": "mail",
"nameAttribute": "displayName"
}

For Active Directory, use sAMAccountName for username-based login or userPrincipalName for email-based login.

New Users

When a user authenticates via OIDC or LDAP for the first time:

1. A new LogTide account is automatically created using their email and name from the identity provider
2. The external identity is linked to the new account
3. User is redirected to the onboarding flow to create or join an organization

Existing Users

When an existing user authenticates:

• Same email: If a local account exists with the same email, the external identity is automatically linked
• Already linked: If the identity is already linked, user is logged in directly

Multiple Providers

Users can have multiple identities linked to one account. For example, a user could:

• Sign up with email/password (local)
• Later link their Okta account for SSO convenience
• Also link their LDAP credentials for on-premise access

How It Works

When auth-free mode is enabled:

• All API requests bypass token validation
• The frontend automatically uses the configured default user
• No login page is shown — users go directly to the dashboard
• The default user must be an admin with at least one organization

Setting Up Auth-Free Mode

1. First, create a local admin account through normal signup
2. Create at least one organization for the admin user
3. Go to Admin > Settings
4. Set Authentication Mode to "Auth-Free (No Login Required)"
5. Select the admin user as the Default User
6. Save changes

After saving, you'll be automatically logged in as the default user. On subsequent visits, no login will be required.

Requirements

Disabling Auth-Free Mode

To re-enable authentication, go to Admin > Settings and set Authentication Mode back to "Standard (Login Required)". Users will then need to log in with their credentials.

Environment Variables

Docker Compose Example

services:
backend:
  image: logtide/backend:latest
  environment:
    # Initial admin (only creates user if no users exist)
    INITIAL_ADMIN_EMAIL: [email protected]
    INITIAL_ADMIN_PASSWORD: your-secure-password
    INITIAL_ADMIN_NAME: Administrator
    # ... other environment variables

Auto-Generated Credentials

If you don't configure INITIAL_ADMIN_* environment variables, LogTide will automatically create a [email protected] admin account with a randomly generated password. The credentials are printed to the console on first startup:

╔════════════════════════════════════════════════════════════════╗
║  INITIAL ADMIN CREDENTIALS (save these!)                       ║
╠════════════════════════════════════════════════════════════════╣
║  Email:    [email protected]                             ║
║  Password: xY7k2mN9pQ4rS1tU...                                 ║
╠════════════════════════════════════════════════════════════════╣
║  Change your password after first login!                       ║
║  Or set INITIAL_ADMIN_* env vars for future deployments.       ║
╚════════════════════════════════════════════════════════════════╝

Check your Docker logs or terminal output for these credentials. We recommend changing the password after first login or using the INITIAL_ADMIN_* environment variables for production deployments.

Disabling Signups

To prevent new user registrations (useful for private instances):

1. Go to Admin > Settings
2. Toggle Signups Enabled to off
3. Save changes

When signups are disabled, the signup link is hidden from the login page. Users can only be created by administrators or through external identity providers (OIDC/LDAP).

Admin Role Management

From the user details page, administrators can promote or demote users:

• Promote to Admin: Gives the user full admin access including system settings, user management, and access to all organizations
• Remove Admin Role: Revokes admin privileges. The user retains their organization memberships and data access

Other User Actions

OIDC Errors

Auth-Free Mode Issues

LDAP Errors

Test with Authentik (OIDC)

Create a docker-compose.authentik.yml file:

# Authentik for testing OIDC integration
# Run: docker compose -f docker-compose.authentik.yml up -d
# Access: http://localhost:9000 (admin setup on first visit)

services:
postgresql-authentik:
  image: docker.io/library/postgres:16-alpine
  restart: unless-stopped
  healthcheck:
    test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
    start_period: 20s
    interval: 30s
    retries: 5
    timeout: 5s
  volumes:
    - authentik-db:/var/lib/postgresql/data
  environment:
    POSTGRES_PASSWORD: authentik-password
    POSTGRES_USER: authentik
    POSTGRES_DB: authentik

redis-authentik:
  image: docker.io/library/redis:alpine
  command: --save 60 1 --loglevel warning
  restart: unless-stopped
  healthcheck:
    test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
    start_period: 20s
    interval: 30s
    retries: 5
    timeout: 3s
  volumes:
    - authentik-redis:/data

authentik-server:
  image: ghcr.io/goauthentik/server:2024.2.2
  restart: unless-stopped
  command: server
  environment:
    AUTHENTIK_REDIS__HOST: redis-authentik
    AUTHENTIK_POSTGRESQL__HOST: postgresql-authentik
    AUTHENTIK_POSTGRESQL__USER: authentik
    AUTHENTIK_POSTGRESQL__NAME: authentik
    AUTHENTIK_POSTGRESQL__PASSWORD: authentik-password
    AUTHENTIK_SECRET_KEY: test-secret-key-change-in-production
  volumes:
    - authentik-media:/media
    - authentik-templates:/templates
  ports:
    - "9000:9000"
    - "9443:9443"
  depends_on:
    - postgresql-authentik
    - redis-authentik

authentik-worker:
  image: ghcr.io/goauthentik/server:2024.2.2
  restart: unless-stopped
  command: worker
  environment:
    AUTHENTIK_REDIS__HOST: redis-authentik
    AUTHENTIK_POSTGRESQL__HOST: postgresql-authentik
    AUTHENTIK_POSTGRESQL__USER: authentik
    AUTHENTIK_POSTGRESQL__NAME: authentik
    AUTHENTIK_POSTGRESQL__PASSWORD: authentik-password
    AUTHENTIK_SECRET_KEY: test-secret-key-change-in-production
  volumes:
    - authentik-media:/media
    - authentik-templates:/templates
  depends_on:
    - postgresql-authentik
    - redis-authentik

volumes:
authentik-db:
authentik-redis:
authentik-media:
authentik-templates:

After starting, visit http://localhost:9000 to set up the admin account, then create an OAuth2/OIDC application for LogTide.

Test with OpenLDAP

Create a docker-compose.ldap.yml file:

# OpenLDAP for testing LDAP integration
# Run: docker compose -f docker-compose.ldap.yml up -d
# Admin UI: http://localhost:8090

services:
openldap:
  image: osixia/openldap:1.5.0
  container_name: logtide-openldap
  environment:
    LDAP_ORGANISATION: "Example Inc"
    LDAP_DOMAIN: "example.org"
    LDAP_ADMIN_PASSWORD: "adminpassword"
    LDAP_CONFIG_PASSWORD: "configpassword"
    LDAP_READONLY_USER: "true"
    LDAP_READONLY_USER_USERNAME: "readonly"
    LDAP_READONLY_USER_PASSWORD: "readonlypassword"
  ports:
    - "389:389"
    - "636:636"
  volumes:
    - ldap-data:/var/lib/ldap
    - ldap-config:/etc/ldap/slapd.d

phpldapadmin:
  image: osixia/phpldapadmin:0.9.0
  container_name: logtide-phpldapadmin
  environment:
    PHPLDAPADMIN_LDAP_HOSTS: openldap
    PHPLDAPADMIN_HTTPS: "false"
  ports:
    - "8090:80"
  depends_on:
    - openldap

volumes:
ldap-data:
ldap-config:

Create LDAP Test User

Create a test-user.ldif file and apply it to create a test user:

# test-user.ldif
dn: ou=users,dc=example,dc=org
objectClass: organizationalUnit
ou: users

dn: cn=testuser,ou=users,dc=example,dc=org
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
cn: testuser
sn: User
givenName: Test
uid: testuser
uidNumber: 1000
gidNumber: 1000
homeDirectory: /home/testuser
mail: [email protected]
userPassword: testpassword

Apply with:

# Copy file to container
docker cp test-user.ldif logtide-openldap:/tmp/test-user.ldif

# Apply LDIF
docker exec logtide-openldap ldapadd -x -D "cn=admin,dc=example,dc=org" -w adminpassword -f /tmp/test-user.ldif

Test credentials: testuser / testpassword