Choose an authentication method

Automation orchestrator uses JSON Web Token (JWT) based authentication with two methods for verifying user identity: local authentication and external identity providers.

Local authentication

Users authenticate with a username and password stored in the automation orchestrator database. Automation orchestrator hashes passwords with Argon2id. Passwords must be at least 14 characters. Passwords must also contain at least 3 of the following 4 character classes: digits (0-9), uppercase letters (A-Z), lowercase letters (a-z), and punctuation or special characters. These requirements apply to all password-setting methods, including the UI, the API, and the orchestrator-admin reset-password CLI command. Use local authentication for the built-in administrator account during initial setup and troubleshooting. For production environments, configure an external identity provider.

External identity providers (OIDC)

Users authenticate through an external OpenID Connect (OIDC) provider. Automation orchestrator acts as an OIDC relying party and supports the authorization code flow with PKCE. Automation orchestrator includes a provider template for Ansible Automation Platform. The custom template supports any OIDC-compliant provider.

Local and identity provider authentication types are mutually exclusive. A local user cannot have an identity provider binding, and an identity provider user cannot set a local password.

Both methods produce the same JWT-based session. After authentication, all users interact with automation orchestrator through the same token mechanism.

You can disable local login for non-builtin users through the Local login runtime setting in Settings > Authentication. When disabled, only the built-in administrator account can authenticate with a password. Identity provider users are not affected.

When you disable a user account, automation orchestrator rejects requests from that user within 5 seconds. The middleware returns a 401 ACCOUNT_DISABLED error. Automation orchestrator exempts the /auth/logout endpoint so disabled users can still terminate their sessions.

Plan authentication deployment

Automation orchestrator follows a phased authentication setup to transition from the built-in administrator account to external identity provider authentication.

Recommended phases

  1. Day 0 (deployment): Use the built-in administrator account to access automation orchestrator immediately. This account uses local credentials generated during deployment. No external identity provider is required at this stage.

  2. Days 1-7 (configuration): Configure an external identity provider and verify administrator access through the external provider. Assign administrator-level roles to at least one identity provider user or group before proceeding.

  3. Day 7+ (production): Disable the built-in administrator account and disable the local login setting. This enforces a single source of identity governance through your external provider.

If you lose access to all administrator accounts, you can recover access through the orchestrator-admin CLI from inside the application pod.