> For the complete documentation index, see [llms.txt](https://docs.lenses.io/latest/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.lenses.io/latest/devx/5.5/deployment/configuration/iam/authentication.md). # Authentication This section describes configuring user authentication in Lenses. Authentication is configured in the security configuration file. Lenses Administrator and Basic Auth do not require any configuration. {% hint style="success" %} Multiple authentication configurations can be used together. Authentication settings go in **security.conf.** {% endhint %} The following authentication methods are available. Users, regardless of the method need to be mapped to groups.
Admin AccountConfigure the Lenses admin account.Admin Account
Azure ADConfigure Azure AD for Lenses.Azure AD
Basic AuthenticationConfigure basic authentication for Lenses.Basic Authentication
Custom HTTPConfigure a custom HTTP endpoint for authentication with Lenses.Custom Http
LDAPConfigure LDAP for Lenses.LDAP
SAML & SSOConfigure SAML & SSO for Lenses.SSO & SAML
## Account Locking For BASIC and LDAP authentication types, there is the option to set a policy to temporarily lock the account when successive login attempts fail. Once the lock time window has passed the user can log in again. These two configuration entries enable the functionality (both of them have to be provided to take effect): {% code title="security.conf" %} ```bash # Number of failed login attempts before an account is locked. lenses.security.lockout.user.attempts.max = "5" # The time in seconds to keep the account locked. lenses.security.lockout.user.period.sec = "600" #10 minutes ``` {% endcode %} ## Group Mapping A **Group** is a collection of permissions that defines the level of access for users belonging to it. Groups consist of: * Namespaces * Application permissions * Administration permissions ### LDAP & Active Directory When working with LDAP or Active Directory, user and group management is done in LDAP. Lenses provides fine-grained role-based access (RBAC) for your existing groups of users over data and applications. Create a group in Lenses with the same name (case-sensitive) as in LDAP/AD. ### SSO & SAML When using an SSO solution such as Azure AD, Google, Okta, OneLogin or an open source like KeyCloak user and group management is done in the Identity Provider. Lenses provides fine-grained role-based access (RBAC) for your existing groups of users over data and applications. Create a group in Lenses with the same name (case-sensitive) as in your SSO group. ### Basic Auth With Basic Authentication, create groups of users and add users to those groups. Authentication and authorization are fully managed, and users can change their passwords. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.lenses.io/latest/devx/5.5/deployment/configuration/iam/authentication.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.