# noust auth

How people sign in to the console besides a password.

```bash
noust auth [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`ldap`](#noust-auth-ldap), [`local-login`](#noust-auth-local-login), [`oidc`](#noust-auth-oidc), [`saml`](#noust-auth-saml), [`scim`](#noust-auth-scim)

## noust auth ldap

Directories people sign in against, with the name and password they have there.

```bash
noust auth ldap [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`link`](#noust-auth-ldap-link), [`remove`](#noust-auth-ldap-remove), [`set`](#noust-auth-ldap-set), [`show`](#noust-auth-ldap-show), [`test`](#noust-auth-ldap-test)

## noust auth ldap link

Link an account to a person in a directory by hand.

```bash
noust auth ldap link [OPTIONS] NAME USERNAME
```

Arguments: `name`, `username`

| Option | What it does | Default |
|---|---|---|
| `--subject` | The directory's stable identifier for the person (entryUUID, objectGUID). |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust auth ldap remove

Remove a directory and its password. People linked to it can no longer sign in through it.

```bash
noust auth ldap remove [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `-f`, `--force` | Do not ask for confirmation. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust auth ldap set

Add a directory, or change one: only the settings given change.

```bash
noust auth ldap set [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--host` | The directory's name or address. |  |
| `--port` | Its port (636 for ldaps, 389 otherwise). |  |
| `--tls` | ldaps, starttls, or none (a directory on this machine only). |  |
| `--ca-file` | A PEM bundle of the authority to trust ('' for the system's). |  |
| `--label` | What the sign-in page says. |  |
| `--enable` | Offer it on the sign-in page. |  |
| `--disable` | Stop offering it. |  |
| `--bind-dn` | The service account that searches ('' to search anonymously). |  |
| `--password-stdin` | Read its password from standard input. |  |
| `--prompt-password` | Ask for its password at a hidden prompt. |  |
| `--clear-bind-password` | Forget its stored password. |  |
| `--user-base` | Where people are searched from, such as ou=people,dc=acme,dc=test. |  |
| `--user-filter` | The search, with {username} where the typed name goes. Default: (&(objectClass=person)(uid={username})) |  |
| `--subject-attribute` | The directory's stable id for a person: entryUUID (OpenLDAP, 389, FreeIPA) or objectGUID (Active Directory). |  |
| `--email-attribute` | Where the address is (mail). |  |
| `--name-attribute` | Where the display name is (displayName). |  |
| `--username-attribute` | Where the login name is (uid, sAMAccountName). |  |
| `--groups-attribute` | Where the entry lists its groups (memberOf). |  |
| `--group-base` | Where groups are searched, when the entry does not list them. |  |
| `--group-filter` | That search, with {dn} and {username}: (&(objectClass=groupOfNames)(member={dn})). |  |
| `--timeout` | Seconds one sign-in may take (1-30). |  |
| `--provisioning` | A first sign-in: off (an administrator links people), invite, or auto (create the account). |  |
| `--default-role` | The role of a created account. |  |
| `--default-team` | The team a created account joins ('' for the default). |  |
| `--default-team-role` | Its role there. |  |
| `--link-by-email` | Link a first sign-in to the account of its address. |  |
| `--no-link-by-email` | Never link by e-mail. |  |
| `--allowed-domain` | Only addresses of this domain (repeat). |  |
| `--clear-domains` | Allow every domain again. |  |
| `--require-email` | Refuse a person with no address. |  |
| `--no-require-email` | Let in people with no address. |  |
| `--group-sync` | Let groups decide roles and teams. |  |
| `--no-group-sync` | Stop letting groups decide. |  |
| `--map-role` | GROUP=ROLE: members get this role (repeat). |  |
| `--map-team` | GROUP=TEAM:ROLE: members join this team (repeat). |  |
| `--map-binding` | GROUP=ROLE@TEAM[/PROJECT[/ENVIRONMENT]]: members hold this role there, a built-in one on a project or a custom one anywhere (repeat). |  |
| `--clear-mappings` | Forget every group mapping. |  |
| `--json` | Print the directory as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust auth ldap show

Show the configured directories, or one in full. Passwords are never shown.

```bash
noust auth ldap show [OPTIONS] [NAME]
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the directories as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust auth ldap test

Look at a directory the way a sign-in would: the connection, the service account, the base.

```bash
noust auth ldap test [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the checks as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust auth local-login

Turn the password and passkey sign-in off once single sign-on is in.

```bash
noust auth local-login [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`exempt`](#noust-auth-local-login-exempt), [`off`](#noust-auth-local-login-off), [`on`](#noust-auth-local-login-on), [`status`](#noust-auth-local-login-status)

## noust auth local-login exempt

The break-glass accounts that keep their password while it is off.

```bash
noust auth local-login exempt [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`add`](#noust-auth-local-login-exempt-add), [`remove`](#noust-auth-local-login-exempt-remove)

## noust auth local-login exempt add

Let an account keep its password and passkeys when they are off.

```bash
noust auth local-login exempt add [OPTIONS] USERNAME
```

Arguments: `username`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust auth local-login exempt remove

Stop an account keeping its password when they are off.

```bash
noust auth local-login exempt remove [OPTIONS] USERNAME
```

Arguments: `username`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust auth local-login off

Stop accepting passwords and passkeys: only the identity provider signs people in.

```bash
noust auth local-login off [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust auth local-login on

Accept passwords and passkeys again.

```bash
noust auth local-login on [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust auth local-login status

Show whether passwords and passkeys still sign accounts in.

```bash
noust auth local-login status [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the setting as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust auth oidc

Single sign-in through an OpenID Connect provider.

```bash
noust auth oidc [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`identities`](#noust-auth-oidc-identities), [`link`](#noust-auth-oidc-link), [`remove`](#noust-auth-oidc-remove), [`set`](#noust-auth-oidc-set), [`show`](#noust-auth-oidc-show), [`test`](#noust-auth-oidc-test), [`unlink`](#noust-auth-oidc-unlink)

## noust auth oidc identities

List the people at providers that are linked to accounts.

```bash
noust auth oidc identities [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--user` | Only this account's. |  |
| `--json` | Print the links as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust auth oidc link

Link an account to a person at a provider, so they sign in as it.

```bash
noust auth oidc link [OPTIONS] NAME USERNAME
```

Arguments: `name`, `username`

| Option | What it does | Default |
|---|---|---|
| `--subject` | The provider's id (sub) for the person: it is in the audit log of a refused sign-in. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust auth oidc remove

Remove a provider and its client secret.

```bash
noust auth oidc remove [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `-f`, `--force` | Do not ask for confirmation. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust auth oidc set

Add an identity provider, or change one: only the settings given change.

```bash
noust auth oidc set [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--kind` | oidc (the default) or github: OAuth 2.0 with GitHub, chosen when the provider is made. |  |
| `--issuer` | The provider's issuer URL, exactly as its tokens write it (a GitHub Enterprise Server's address for --kind github). |  |
| `--client-id` | The client id Noust is registered as. |  |
| `--client-secret-stdin` | Read the client secret from standard input. |  |
| `--prompt-secret` | Ask for the client secret at a hidden prompt. |  |
| `--clear-secret` | Forget the stored client secret (a public client). |  |
| `--label` | What the button says after 'Sign in with'. |  |
| `--scopes` | Space separated; openid is always asked. |  |
| `--enable` | Offer it on the sign-in page. |  |
| `--disable` | Stop offering it, and refuse its answers. |  |
| `--require-email-verified` | Refuse a sign-in whose e-mail the provider does not vouch for (the default). |  |
| `--allow-unverified-email` | Let in people whose e-mail is not verified; it is then never used to find an account. |  |
| `--assume-email-verified` | Treat an e-mail the provider says nothing about as verified (Microsoft Entra, a managed directory). |  |
| `--no-assume-email-verified` | Never assume it (the default). |  |
| `--clock-skew` | Seconds of clock difference to forgive (0-300). |  |
| `--provisioning` | A first sign-in: off (an administrator links people), invite, or auto (create the account). |  |
| `--default-role` | The role of an account that provisioning creates. |  |
| `--default-team` | The team a created account joins ('' for the default team). |  |
| `--default-team-role` | Its role there. |  |
| `--link-by-email` | Link a first sign-in to the account of its verified e-mail (only one with a second factor). |  |
| `--no-link-by-email` | Never link by e-mail. |  |
| `--allowed-domain` | Only e-mail addresses of this domain (repeat for several). |  |
| `--clear-domains` | Allow every domain again. |  |
| `--require-amr` | The provider must say it used one of these methods, such as mfa (repeat for several). |  |
| `--clear-amr` | Require no method. |  |
| `--groups-claim` | Where the token lists groups; nest with '>'. |  |
| `--group-sync` | Let groups decide roles and teams at every sign-in. |  |
| `--no-group-sync` | Stop letting groups decide. |  |
| `--map-role` | GROUP=ROLE: members get this role (repeat). |  |
| `--map-team` | GROUP=TEAM:ROLE: members join this team (repeat). |  |
| `--map-binding` | GROUP=ROLE@TEAM[/PROJECT[/ENVIRONMENT]]: members hold this role there, a built-in one on a project or a custom one anywhere (repeat). |  |
| `--clear-mappings` | Forget every group mapping. |  |
| `--redirect-uri` | The callback address, when it cannot be worked out ('' to clear). |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust auth oidc show

Show the configured providers, or one in full. Secrets are never shown.

```bash
noust auth oidc show [OPTIONS] [NAME]
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the providers as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust auth oidc test

Look at a provider the way a sign-in would: discovery, keys, secret, callback.

```bash
noust auth oidc test [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the checks as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust auth oidc unlink

Cut a link ('noust auth oidc identities' lists them with their ids).

```bash
noust auth oidc unlink [OPTIONS] IDENTITY_ID
```

Arguments: `identity_id`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust auth saml

SAML 2.0 identity providers people sign in with (Entra ID, Okta, Keycloak, ADFS).

```bash
noust auth saml [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`link`](#noust-auth-saml-link), [`metadata`](#noust-auth-saml-metadata), [`remove`](#noust-auth-saml-remove), [`set`](#noust-auth-saml-set), [`show`](#noust-auth-saml-show), [`test`](#noust-auth-saml-test)

## noust auth saml link

Link an account to a person at a SAML provider by hand.

```bash
noust auth saml link [OPTIONS] NAME USERNAME
```

Arguments: `name`, `username`

| Option | What it does | Default |
|---|---|---|
| `--subject` | The provider's identifier for the person: their NameID, or the subject attribute. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust auth saml metadata

Print this server's SAML metadata for a provider, to register it with the identity provider.

```bash
noust auth saml metadata [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--origin` | The console's address, https://host (default: web.public_url). |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust auth saml remove

Remove a SAML provider. People linked to it can no longer sign in through it.

```bash
noust auth saml remove [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `-f`, `--force` | Do not ask for confirmation. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust auth saml set

Add a SAML provider, or change one: only the settings given change.

```bash
noust auth saml set [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--metadata-file` | The identity provider's metadata XML ('-' reads standard input): its entity id, sign-in address and signing certificates. |  |
| `--entity-id` | Its entity id (issuer). |  |
| `--sso-url` | Its sign-in address (HTTP-Redirect binding). |  |
| `--certificate-file` | A file with its signing certificate in PEM (repeat for a rollover). Replaces the list. |  |
| `--sp-entity-id` | The entity id this server presents ('' to derive it from the console's address). |  |
| `--label` | What the sign-in page says. |  |
| `--enable` | Offer it on the sign-in page. |  |
| `--disable` | Stop offering it. |  |
| `--subject-attribute` | The attribute that identifies a person ('' to use the NameID, which should be persistent). |  |
| `--email-attribute` | Where the address is (email). |  |
| `--name-attribute` | Where the display name is (displayName). |  |
| `--username-attribute` | Where the login name is. |  |
| `--groups-attribute` | Where the groups are listed (groups). |  |
| `--clock-skew` | Tolerated clock difference, seconds. |  |
| `--provisioning` | A first sign-in: off (an administrator links people), invite, or auto (create the account). |  |
| `--default-role` | The role of a created account. |  |
| `--default-team` | The team a created account joins ('' for the default). |  |
| `--default-team-role` | Its role there. |  |
| `--link-by-email` | Link a first sign-in to the account of its address. |  |
| `--no-link-by-email` | Never link by e-mail. |  |
| `--allowed-domain` | Only addresses of this domain (repeat). |  |
| `--clear-domains` | Allow every domain again. |  |
| `--require-context` | An authentication context class the provider must report (repeat; one of them). |  |
| `--clear-contexts` | Require no particular authentication. |  |
| `--require-email` | Refuse a person with no address. |  |
| `--no-require-email` | Let in people with no address. |  |
| `--group-sync` | Let groups decide roles and teams. |  |
| `--no-group-sync` | Stop letting groups decide. |  |
| `--map-role` | GROUP=ROLE: members get this role (repeat). |  |
| `--map-team` | GROUP=TEAM:ROLE: members join this team (repeat). |  |
| `--map-binding` | GROUP=ROLE@TEAM[/PROJECT[/ENVIRONMENT]]: members hold this role there, a built-in one on a project or a custom one anywhere (repeat). |  |
| `--clear-mappings` | Forget every group mapping. |  |
| `--origin` | The console's address, to show what to register. |  |
| `--json` | Print the provider as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust auth saml show

Show the configured SAML providers, or one in full.

```bash
noust auth saml show [OPTIONS] [NAME]
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--origin` | The console's address, to show what to register. |  |
| `--json` | Print the providers as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust auth saml test

Look at a provider the way a sign-in would: its certificates, its address, what it is told.

```bash
noust auth saml test [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--origin` | The console's address (default: web.public_url). |  |
| `--json` | Print the checks as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust auth scim

Identity providers that provision accounts (SCIM 2.0): who may have one, and who left.

```bash
noust auth scim [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`remove`](#noust-auth-scim-remove), [`set`](#noust-auth-scim-set), [`show`](#noust-auth-scim-show), [`users`](#noust-auth-scim-users)

## noust auth scim remove

Remove a source and its roster. Its token stops working; its accounts stay as they are.

```bash
noust auth scim remove [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `-f`, `--force` | Do not ask for confirmation. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust auth scim set

Add an identity provider that provisions accounts, or change one.

```bash
noust auth scim set [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--label` | What a person reads about it. |  |
| `--enable` | Accept its token. |  |
| `--disable` | Refuse its token (its accounts stay as they are). |  |
| `--rotate-token` | Issue a new token; the old one stops working at once. |  |
| `--default-role` | The role of an account it creates (never security or auditor). |  |
| `--default-team` | The team a created account joins ('' for the default). |  |
| `--default-team-role` | Its role there. |  |
| `--link-by-email` | Attach a provisioned person to the account that already has their e-mail. |  |
| `--no-link-by-email` | Never attach by e-mail. |  |
| `--allowed-domain` | Only provision e-mail addresses of this domain (repeat for several). |  |
| `--clear-domains` | Provision every domain again. |  |
| `--group-sync` | Let groups decide roles and teams. |  |
| `--no-group-sync` | Stop letting groups decide. |  |
| `--map-role` | GROUP=ROLE: members get this role (repeat). |  |
| `--map-team` | GROUP=TEAM:ROLE: members join this team (repeat). |  |
| `--map-binding` | GROUP=ROLE@TEAM[/PROJECT[/ENVIRONMENT]]: members hold this role there, a built-in one on a project or a custom one anywhere (repeat). |  |
| `--clear-mappings` | Forget every group mapping. |  |
| `--json` | Print the source as JSON, with its token when one was issued. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust auth scim show

Show the sources, or one in full. Tokens are never shown.

```bash
noust auth scim show [OPTIONS] [NAME]
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the sources as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust auth scim users

List the people a source provisioned, with the state of their account.

```bash
noust auth scim users [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the roster as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |