Authenticate on-premises AxoConsole users with an existing identity system through Dex, and switch over from the built-in provider.
Authentication
Choose between the built-in identity provider and Dex for logging in to an on-premises AxoConsole.
AxoConsole supports the following authentication providers for on-premises deployments:
| Provider | Description | When to use |
|---|---|---|
| Built-in (axoidp) | Axoflow’s built-in identity provider | Default for all installations. Manages local users with username and password. |
| Dex | Open-source identity federation layer | Use when you want to authenticate users with an existing identity system such as LDAP, Google, or GitHub. |
The built-in provider is enabled automatically during installation. To use a different provider, see the relevant section below.
The built-in provider is served under the main domain of your AxoConsole deployment at https://<your-host.your-domain>/idp, so it doesn’t need a separate subdomain. Dex is served at https://idp.<your-host.your-domain>: this subdomain must resolve to the AxoConsole IP address from your desktop and from every AxoRouter and Axoflow agent host. The prepare-axorouter-host.sh script generated by the installer doesn’t add it to /etc/hosts.
By default, the installer creates the admin user of the built-in provider with a generated password. To set the password yourself, or to let the first registered user become the admin instead, use the --idp-admin-password or --idp-bootstrap installer flag. For details, see Install AxoConsole.
Dex