> ## Documentation Index
> Fetch the complete documentation index at: https://ayakaleaf-pro.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Configure logins on a Kubernetes deployment - OIDC, SAML, LDAP, public access, reCAPTCHA and password rules.

All login methods run in the **web** service of every Ayakaleaf Pro pod. None of them needs an extra pod or a periodic job, and all of them keep their login state in the session in Redis, so they work the same with one replica or several. What differs on Kubernetes is where the settings, secrets and certificates go and which network paths must be open:

| Method | Secret `overleaf-secrets` | Secret `overleaf-certs` | Pods must reach |
| - | - | - | - |
| [OIDC](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/authentication/oidc-authentication.md) | `OVERLEAF_OIDC_CLIENT_SECRET` | your CA, if private | the OP's token and userinfo endpoints |
| [SAML](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/authentication/saml-authentication.md) | – | the IdP certificate, Overleaf's own key | nothing: messages go through the browser |
| [LDAP](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/authentication/ldap-authentication.md) | `OVERLEAF_LDAP_BIND_CREDENTIALS` | the LDAP CA, if private | the LDAP server |
| [Public Access](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/authentication/public-access.md) | SMTP password, for activation emails | – | the SMTP server |
| [reCAPTCHA](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/authentication/recaptcha.md) | `RECAPTCHA_SECRET_KEY`, `DEVICE_HISTORY_SECRET` | – | `www.google.com` (or `RECAPTCHA_ENDPOINT`) |
| [Password restrictions](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/authentication/password-restrictions.md) | – | – | – |

`EXTERNAL_AUTH` turns the SSO methods on, as a space-separated list in the ConfigMap, for example `EXTERNAL_AUTH: ldap oidc`. Accounts and what users may change with SSO on are the same as on the Toolkit, see [Authentication](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/overleaf-toolkit/authentication).

> [!WARNING]
>
> A method whose settings are wrong does not stop the pod from becoming ready: web logs `error setting up passport in modules` in `/var/log/overleaf/web.log` and that method, and the ones after it in the order `ldap`, `saml`, `oidc`, stay off. Check the log after every change. We tried it with `EXTERNAL_AUTH: saml oidc` and a missing IdP certificate: the pod became ready, and both `/saml/login` and `/oidc/login` answered "Something went wrong" (500) until the certificate path was fixed.

> [card] [OIDC Authentication](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/authentication/oidc-authentication.md)

> [card] [SAML Authentication](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/authentication/saml-authentication.md)

> [card] [LDAP Authentication](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/authentication/ldap-authentication.md)

> [card] [Public Access](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/authentication/public-access.md)

> [card] [reCAPTCHA](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/authentication/recaptcha.md)

> [card] [Password restrictions](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/authentication/password-restrictions.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.