Heimdall Authentication Methods

Heimdall supports multiple authentication methods:

• External URL
• LDAP
• OAuth Client ID (Google, GitHub, Okta Domain)
• Custom OIDC Service
• Password-based authentication (Local Authentication)

Local Authentication

Local authentication is the minimal and lowest level of authentication, it is accomplished via username password. Strong passwords are enforced. Passwords are encrypted and stored on the application database (only applicable if deployed in server mode).

NOTE: Password encryption is being changed to a FIPS compliant algorithm, for this reason current deployment of Heimdall that make use of Local Authentication must ensure that all users change their passwords during the transition period.

External Authentication Only

Heimdall Server supports disabling local user logins via environment variables. This means only external authentication providers (such as OpenID Connect or LDAP) can be used to login to the server.

To use this feature set the following environment variables:

• LOCAL_LOGIN_DISABLED=true
• ADMIN_USES_EXTERNAL_AUTH=true
• ADMIN_EMAIL=<Your admin's email address>

Instead of the standard prompt, you will be given this message and the option to login with your configured authentication providers: