Skip to main content

Sign-in and identity

Every sign-in method resolves to a local Jiandu account and the same local roles and permissions. An external identity provider proves identity; it does not become the source of Jiandu authorization.

Available methods​

  • Local password for a straightforward local account.
  • Passkey as an optional phishing-resistant method.
  • OIDC as the recommended external identity integration.
  • TLS-protected LDAP or Active Directory for established directory deployments.
  • Trusted reverse-proxy assertion as an expert compatibility option with a protected peer and shared secret.
  • Personal access token for scripts and integrations, not browser sign-in.
  1. Keep the owner recovery token offline.
  2. Create at least one named human Administrator.
  3. Test a second ordinary Member account.
  4. Add one external provider at a time.
  5. Link an existing account only from a fresh authenticated session.
  6. Keep a tested local recovery route before depending on an external provider.

Use stable provider identifiers and immutable external subjects. Display names and email addresses can change and should not be treated as durable identity keys.

Reverse-proxy sign-in is not ordinary proxying​

Only enable trusted-proxy assertions when the proxy itself authenticates users, the direct peer address is restricted, the connection is protected, and a shared secret proves the assertion came from that proxy. A header reachable from the public internet is not authentication.

See people and access for day-to-day authorization.