Skip to content
GitHub 6 Install 
curl -fsSL https://noust.dev/install.sh | sh

Language

Esta página solo está en inglés: abre la portada de la documentación.

Theme
Install GitHub 6
Pages in Reference

noust auth

How people sign in to the console besides a password.

Reference Updated View as Markdown
Shell
noust auth [OPTIONS] COMMAND [ARGS]...

Subcommands: ldap, local-login, oidc, saml, scim

noust auth ldap

Directories people sign in against, with the name and password they have there.

Shell
noust auth ldap [OPTIONS] COMMAND [ARGS]...

Subcommands: link, remove, set, show, test

Link an account to a person in a directory by hand.

Shell
noust auth ldap link [OPTIONS] NAME USERNAME

Arguments: name, username

Option What it does Default
--subject The directory's stable identifier for the person (entryUUID, objectGUID).
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust auth ldap remove

Remove a directory and its password. People linked to it can no longer sign in through it.

Shell
noust auth ldap remove [OPTIONS] NAME

Arguments: name

Option What it does Default
-f, --force Do not ask for confirmation.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust auth ldap set

Add a directory, or change one: only the settings given change.

Shell
noust auth ldap set [OPTIONS] NAME

Arguments: name

Option What it does Default
--host The directory's name or address.
--port Its port (636 for ldaps, 389 otherwise).
--tls ldaps, starttls, or none (a directory on this machine only).
--ca-file A PEM bundle of the authority to trust ('' for the system's).
--label What the sign-in page says.
--enable Offer it on the sign-in page.
--disable Stop offering it.
--bind-dn The service account that searches ('' to search anonymously).
--password-stdin Read its password from standard input.
--prompt-password Ask for its password at a hidden prompt.
--clear-bind-password Forget its stored password.
--user-base Where people are searched from, such as ou=people,dc=acme,dc=test.
--user-filter The search, with {username} where the typed name goes. Default: (&(objectClass=person)(uid={username}))
--subject-attribute The directory's stable id for a person: entryUUID (OpenLDAP, 389, FreeIPA) or objectGUID (Active Directory).
--email-attribute Where the address is (mail).
--name-attribute Where the display name is (displayName).
--username-attribute Where the login name is (uid, sAMAccountName).
--groups-attribute Where the entry lists its groups (memberOf).
--group-base Where groups are searched, when the entry does not list them.
--group-filter That search, with {dn} and {username}: (&(objectClass=groupOfNames)(member={dn})).
--timeout Seconds one sign-in may take (1-30).
--provisioning A first sign-in: off (an administrator links people), invite, or auto (create the account).
--default-role The role of a created account.
--default-team The team a created account joins ('' for the default).
--default-team-role Its role there.
--link-by-email Link a first sign-in to the account of its address.
--no-link-by-email Never link by e-mail.
--allowed-domain Only addresses of this domain (repeat).
--clear-domains Allow every domain again.
--require-email Refuse a person with no address.
--no-require-email Let in people with no address.
--group-sync Let groups decide roles and teams.
--no-group-sync Stop letting groups decide.
--map-role GROUP=ROLE: members get this role (repeat).
--map-team GROUP=TEAM:ROLE: members join this team (repeat).
--map-binding GROUP=ROLE@TEAM[/PROJECT[/ENVIRONMENT]]: members hold this role there, a built-in one on a project or a custom one anywhere (repeat).
--clear-mappings Forget every group mapping.
--json Print the directory as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust auth ldap show

Show the configured directories, or one in full. Passwords are never shown.

Shell
noust auth ldap show [OPTIONS] [NAME]

Arguments: name

Option What it does Default
--json Print the directories as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust auth ldap test

Look at a directory the way a sign-in would: the connection, the service account, the base.

Shell
noust auth ldap test [OPTIONS] NAME

Arguments: name

Option What it does Default
--json Print the checks as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust auth local-login

Turn the password and passkey sign-in off once single sign-on is in.

Shell
noust auth local-login [OPTIONS] COMMAND [ARGS]...

Subcommands: exempt, off, on, status

noust auth local-login exempt

The break-glass accounts that keep their password while it is off.

Shell
noust auth local-login exempt [OPTIONS] COMMAND [ARGS]...

Subcommands: add, remove

noust auth local-login exempt add

Let an account keep its password and passkeys when they are off.

Shell
noust auth local-login exempt add [OPTIONS] USERNAME

Arguments: username

Option What it does Default
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust auth local-login exempt remove

Stop an account keeping its password when they are off.

Shell
noust auth local-login exempt remove [OPTIONS] USERNAME

Arguments: username

Option What it does Default
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust auth local-login off

Stop accepting passwords and passkeys: only the identity provider signs people in.

Shell
noust auth local-login off [OPTIONS]
Option What it does Default
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust auth local-login on

Accept passwords and passkeys again.

Shell
noust auth local-login on [OPTIONS]
Option What it does Default
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust auth local-login status

Show whether passwords and passkeys still sign accounts in.

Shell
noust auth local-login status [OPTIONS]
Option What it does Default
--json Print the setting as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust auth oidc

Single sign-in through an OpenID Connect provider.

Shell
noust auth oidc [OPTIONS] COMMAND [ARGS]...

Subcommands: identities, link, remove, set, show, test, unlink

noust auth oidc identities

List the people at providers that are linked to accounts.

Shell
noust auth oidc identities [OPTIONS]
Option What it does Default
--user Only this account's.
--json Print the links as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

Link an account to a person at a provider, so they sign in as it.

Shell
noust auth oidc link [OPTIONS] NAME USERNAME

Arguments: name, username

Option What it does Default
--subject The provider's id (sub) for the person: it is in the audit log of a refused sign-in.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust auth oidc remove

Remove a provider and its client secret.

Shell
noust auth oidc remove [OPTIONS] NAME

Arguments: name

Option What it does Default
-f, --force Do not ask for confirmation.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust auth oidc set

Add an identity provider, or change one: only the settings given change.

Shell
noust auth oidc set [OPTIONS] NAME

Arguments: name

Option What it does Default
--kind oidc (the default) or github: OAuth 2.0 with GitHub, chosen when the provider is made.
--issuer The provider's issuer URL, exactly as its tokens write it (a GitHub Enterprise Server's address for --kind github).
--client-id The client id Noust is registered as.
--client-secret-stdin Read the client secret from standard input.
--prompt-secret Ask for the client secret at a hidden prompt.
--clear-secret Forget the stored client secret (a public client).
--label What the button says after 'Sign in with'.
--scopes Space separated; openid is always asked.
--enable Offer it on the sign-in page.
--disable Stop offering it, and refuse its answers.
--require-email-verified Refuse a sign-in whose e-mail the provider does not vouch for (the default).
--allow-unverified-email Let in people whose e-mail is not verified; it is then never used to find an account.
--assume-email-verified Treat an e-mail the provider says nothing about as verified (Microsoft Entra, a managed directory).
--no-assume-email-verified Never assume it (the default).
--clock-skew Seconds of clock difference to forgive (0-300).
--provisioning A first sign-in: off (an administrator links people), invite, or auto (create the account).
--default-role The role of an account that provisioning creates.
--default-team The team a created account joins ('' for the default team).
--default-team-role Its role there.
--link-by-email Link a first sign-in to the account of its verified e-mail (only one with a second factor).
--no-link-by-email Never link by e-mail.
--allowed-domain Only e-mail addresses of this domain (repeat for several).
--clear-domains Allow every domain again.
--require-amr The provider must say it used one of these methods, such as mfa (repeat for several).
--clear-amr Require no method.
--groups-claim Where the token lists groups; nest with '>'.
--group-sync Let groups decide roles and teams at every sign-in.
--no-group-sync Stop letting groups decide.
--map-role GROUP=ROLE: members get this role (repeat).
--map-team GROUP=TEAM:ROLE: members join this team (repeat).
--map-binding GROUP=ROLE@TEAM[/PROJECT[/ENVIRONMENT]]: members hold this role there, a built-in one on a project or a custom one anywhere (repeat).
--clear-mappings Forget every group mapping.
--redirect-uri The callback address, when it cannot be worked out ('' to clear).
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust auth oidc show

Show the configured providers, or one in full. Secrets are never shown.

Shell
noust auth oidc show [OPTIONS] [NAME]

Arguments: name

Option What it does Default
--json Print the providers as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust auth oidc test

Look at a provider the way a sign-in would: discovery, keys, secret, callback.

Shell
noust auth oidc test [OPTIONS] NAME

Arguments: name

Option What it does Default
--json Print the checks as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

Cut a link ('noust auth oidc identities' lists them with their ids).

Shell
noust auth oidc unlink [OPTIONS] IDENTITY_ID

Arguments: identity_id

Option What it does Default
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust auth saml

SAML 2.0 identity providers people sign in with (Entra ID, Okta, Keycloak, ADFS).

Shell
noust auth saml [OPTIONS] COMMAND [ARGS]...

Subcommands: link, metadata, remove, set, show, test

Link an account to a person at a SAML provider by hand.

Shell
noust auth saml link [OPTIONS] NAME USERNAME

Arguments: name, username

Option What it does Default
--subject The provider's identifier for the person: their NameID, or the subject attribute.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust auth saml metadata

Print this server's SAML metadata for a provider, to register it with the identity provider.

Shell
noust auth saml metadata [OPTIONS] NAME

Arguments: name

Option What it does Default
--origin The console's address, https://host (default: web.public_url).
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust auth saml remove

Remove a SAML provider. People linked to it can no longer sign in through it.

Shell
noust auth saml remove [OPTIONS] NAME

Arguments: name

Option What it does Default
-f, --force Do not ask for confirmation.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust auth saml set

Add a SAML provider, or change one: only the settings given change.

Shell
noust auth saml set [OPTIONS] NAME

Arguments: name

Option What it does Default
--metadata-file The identity provider's metadata XML ('-' reads standard input): its entity id, sign-in address and signing certificates.
--entity-id Its entity id (issuer).
--sso-url Its sign-in address (HTTP-Redirect binding).
--certificate-file A file with its signing certificate in PEM (repeat for a rollover). Replaces the list.
--sp-entity-id The entity id this server presents ('' to derive it from the console's address).
--label What the sign-in page says.
--enable Offer it on the sign-in page.
--disable Stop offering it.
--subject-attribute The attribute that identifies a person ('' to use the NameID, which should be persistent).
--email-attribute Where the address is (email).
--name-attribute Where the display name is (displayName).
--username-attribute Where the login name is.
--groups-attribute Where the groups are listed (groups).
--clock-skew Tolerated clock difference, seconds.
--provisioning A first sign-in: off (an administrator links people), invite, or auto (create the account).
--default-role The role of a created account.
--default-team The team a created account joins ('' for the default).
--default-team-role Its role there.
--link-by-email Link a first sign-in to the account of its address.
--no-link-by-email Never link by e-mail.
--allowed-domain Only addresses of this domain (repeat).
--clear-domains Allow every domain again.
--require-context An authentication context class the provider must report (repeat; one of them).
--clear-contexts Require no particular authentication.
--require-email Refuse a person with no address.
--no-require-email Let in people with no address.
--group-sync Let groups decide roles and teams.
--no-group-sync Stop letting groups decide.
--map-role GROUP=ROLE: members get this role (repeat).
--map-team GROUP=TEAM:ROLE: members join this team (repeat).
--map-binding GROUP=ROLE@TEAM[/PROJECT[/ENVIRONMENT]]: members hold this role there, a built-in one on a project or a custom one anywhere (repeat).
--clear-mappings Forget every group mapping.
--origin The console's address, to show what to register.
--json Print the provider as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust auth saml show

Show the configured SAML providers, or one in full.

Shell
noust auth saml show [OPTIONS] [NAME]

Arguments: name

Option What it does Default
--origin The console's address, to show what to register.
--json Print the providers as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust auth saml test

Look at a provider the way a sign-in would: its certificates, its address, what it is told.

Shell
noust auth saml test [OPTIONS] NAME

Arguments: name

Option What it does Default
--origin The console's address (default: web.public_url).
--json Print the checks as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust auth scim

Identity providers that provision accounts (SCIM 2.0): who may have one, and who left.

Shell
noust auth scim [OPTIONS] COMMAND [ARGS]...

Subcommands: remove, set, show, users

noust auth scim remove

Remove a source and its roster. Its token stops working; its accounts stay as they are.

Shell
noust auth scim remove [OPTIONS] NAME

Arguments: name

Option What it does Default
-f, --force Do not ask for confirmation.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust auth scim set

Add an identity provider that provisions accounts, or change one.

Shell
noust auth scim set [OPTIONS] NAME

Arguments: name

Option What it does Default
--label What a person reads about it.
--enable Accept its token.
--disable Refuse its token (its accounts stay as they are).
--rotate-token Issue a new token; the old one stops working at once.
--default-role The role of an account it creates (never security or auditor).
--default-team The team a created account joins ('' for the default).
--default-team-role Its role there.
--link-by-email Attach a provisioned person to the account that already has their e-mail.
--no-link-by-email Never attach by e-mail.
--allowed-domain Only provision e-mail addresses of this domain (repeat for several).
--clear-domains Provision every domain again.
--group-sync Let groups decide roles and teams.
--no-group-sync Stop letting groups decide.
--map-role GROUP=ROLE: members get this role (repeat).
--map-team GROUP=TEAM:ROLE: members join this team (repeat).
--map-binding GROUP=ROLE@TEAM[/PROJECT[/ENVIRONMENT]]: members hold this role there, a built-in one on a project or a custom one anywhere (repeat).
--clear-mappings Forget every group mapping.
--json Print the source as JSON, with its token when one was issued.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust auth scim show

Show the sources, or one in full. Tokens are never shown.

Shell
noust auth scim show [OPTIONS] [NAME]

Arguments: name

Option What it does Default
--json Print the sources as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust auth scim users

List the people a source provisioned, with the state of their account.

Shell
noust auth scim users [OPTIONS] NAME

Arguments: name

Option What it does Default
--json Print the roster as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

Something on this page is wrong or unclear? Report it on GitHub.

Help, contributing and the project’s policies are under Project.

Search the documentation

Type to search every page.

↑ ↓ to move, Enter to open, Esc to close