Authentication

Configure logins on a Kubernetes deployment - OIDC, SAML, LDAP, public access, reCAPTCHA and password rules.

All login methods run in the web service of every Ayakaleaf Pro pod. None of them needs an extra pod or a periodic job, and all of them keep their login state in the session in Redis, so they work the same with one replica or several. What differs on Kubernetes is where the settings, secrets and certificates go and which network paths must be open:

Method	Secret overleaf-secrets	Secret overleaf-certs	Pods must reach
OIDC	OVERLEAF_OIDC_CLIENT_SECRET	your CA, if private	the OP’s token and userinfo endpoints
SAML	–	the IdP certificate, Overleaf’s own key	nothing: messages go through the browser
LDAP	OVERLEAF_LDAP_BIND_CREDENTIALS	the LDAP CA, if private	the LDAP server
Public Access	SMTP password, for activation emails	–	the SMTP server
reCAPTCHA	RECAPTCHA_SECRET_KEY, DEVICE_HISTORY_SECRET	–	www.google.com (or RECAPTCHA_ENDPOINT)
Password restrictions	–	–	–

EXTERNAL_AUTH turns the SSO methods on, as a space-separated list in the ConfigMap, for example EXTERNAL_AUTH: ldap oidc. Accounts and what users may change with SSO on are the same as on the Toolkit, see Authentication.

A method whose settings are wrong does not stop the pod from becoming ready: web logs error setting up passport in modules in /var/log/overleaf/web.log and that method, and the ones after it in the order ldap, saml, oidc, stay off. Check the log after every change. We tried it with EXTERNAL_AUTH: saml oidc and a missing IdP certificate: the pod became ready, and both /saml/login and /oidc/login answered “Something went wrong” (500) until the certificate path was fixed.

OIDC Authentication

SAML Authentication

LDAP Authentication

Public Access

reCAPTCHA

Password restrictions