How to configure authentik as login method for the LXD UI and CLI¶

authentik is a self-hosted open source identity provider. authentik supports OIDC and can be used to authenticate users for the LXD UI and CLI. This guide shows you how to set up authentik as the login method for the LXD UI and CLI.

You need two authentik providers: a confidential provider for the LXD UI, and a public provider using the device code flow for the LXD CLI.

This guide assumes that authentik is available over HTTPS, and that LXD is initialized and accessible over HTTPS (see How to expose LXD to the network).

Using authentik to access LXD¶

Set up authentik using their installation guide, then open the authentik Admin Console and sign in as an administrator.
Create the provider for the LXD UI. From the main navigation, select Applications > Providers, then click New Provider and select OAuth2/OpenID Provider.
- Enter a Name, such as LXD.
- Select an Authorization flow, either implicit or explicit consent.
- Set the Client type to Confidential.
- Set the Grant types to Authorization Code and Refresh Token.
- Under Redirect URIs/Origins, click Add Entry and enter your LXD UI address, followed by /oidc/callback.
  - Example: https://example.com:8443/oidc/callback
  - An IP address can be used instead of a domain name.
  - Note :8443 is the default listening port for the LXD server. It might differ for your setup. You can verify the LXD configuration value core.https_address to find the correct port for your LXD server.
- Click Create, then reopen the provider and copy the Client ID and Client Secret. You need both in a later step.
Create the provider for the LXD CLI. Select Applications > Providers again, then click New Provider and select OAuth2/OpenID Provider.
- Enter a Name, such as LXD-CLI.
- Select an Authorization flow, either implicit or explicit consent.
- Set the Client type to Public. Public clients have no client secret.
- Set the Grant types to Refresh Token and Device Code.
- Under Redirect URIs/Origins, click Add Entry and enter the same address that you used for the LXD provider.
- Click Create, then reopen the provider and copy the Client ID. You need it in a later step.
- While editing the provider, under Machine-to-machine authentication settings, move LXD-CLI into the Selected Providers list for Federated OAuth2/OpenID Providers.
Make sure that a device code flow is configured on the active brand. The LXD CLI needs it to complete the device code login. If your brand already has a device code flow, skip this step.
- Select Flows & Stages > Flows, then click New Flow.
  - Enter default-device-code-flow as the Name, Title and Slug.
  - Set the Designation to Stage Configuration.
  - Set the Authentication to Require authentication.
  - Click Create Flow.
- Select System > Brands, edit the active brand and under Default Flows set its Device code flow to default-device-code-flow.
Create an application for each provider. From the main navigation, select Applications > Applications, then use New Application with Existing Provider and choose the existing provider.
- Create an application named LXD and select the LXD provider.
- Create an application named LXD-CLI and select the LXD-CLI provider.
- Note the Slug of the LXD application. It is part of the issuer URL in the next step.
Configure your LXD server with the values that you collected above. For <authentik-url>, use the URL of your authentik server, and for <lxd-application-slug>, use the slug of the LXD application.
```
lxc config set oidc.issuer=https://<authentik-url>/application/o/<lxd-application-slug>/
lxc config set oidc.client.id=<LXD provider client ID>
lxc config set oidc.client.secret=<LXD provider client secret>
lxc config set oidc.device.client.id=<LXD-CLI provider client ID>
lxc config set oidc.audience=<LXD provider client ID>
```
oidc.client.id and oidc.client.secret are used by the LXD UI, and oidc.device.client.id is used by the LXD CLI. Setting oidc.device.client.id requires oidc.client.id to be set. oidc.audience must be the client ID of the LXD provider, so that LXD accepts the tokens that authentik issues for both providers.

Now you can access the LXD UI with any browser and use SSO login. Enter the credentials for authentik.

To use OIDC on the LXD CLI, run:

lxc remote add <remote-name> <LXD address> --auth-type oidc

This displays a login code and opens a browser. Confirm the code and log in with the credentials for authentik.

Users will have no permissions by default. You must set up LXD authorization groups to grant access to projects and instances. For connecting the LXD authorization groups to a user you have two options:

Map a LXD authorization group to the user directly. Note, that the user object in LXD will only be created on the first login of that user to LXD.
Configure groups in authentik and use automatic mapping to LXD authorization groups as described below.

Set up automatic group mappings¶

An admin can set up groups in authentik and add users to those groups. When a user in a group logs in via OIDC, their authentik groups can be mapped to LXD authorization groups. This section details the steps for configuring groups in authentik so that LXD can map them to its authorization groups.

In the authentik Admin Console, select Directory > Groups, then click New Group. Enter a Name, such as lxd-admins, and click Create.
Open the new group and select its Users tab. Add the users that should be part of this group.
Tell LXD which claim contains the groups. authentik includes a groups claim in the default authentik default OAuth Mapping: OpenID 'profile' scope, and LXD requests the profile scope by default (see oidc.scopes):
```
lxc config set oidc.groups.claim=groups
```

Map the authentik group from step 1 to a LXD authorization group. The name of the identity provider group must match the authentik group name exactly:

lxc auth identity-provider-group create <authentik-group-name>
lxc auth identity-provider-group group add <authentik-group-name> <LXD-group-name>

During the OIDC flow, LXD automatically extracts the claim from the user’s id_token based on the LXD oidc.groups.claim configuration value. The extracted claim is an array of the authentik groups for your user. Those groups are then mapped to LXD authorization groups using the identity provider group created in step 4.