Update the auth configuration
PATCH /admin/system/auth
Persists the password policy and SSO provider list. The
providers are stored but NOT enforced for login yet —
enforcement (LDAP/SAML/OAuth login flows) is its own future
phase. Per-provider config (config map) is opaque here;
the integration code validates the shape at use time.
Authorizations
Section titled “Authorizations ”Request Body required
Section titled “Request Body required ”Authentication + SSO configuration. Persisted under the
sysconfig key auth. The password policy applies only to
local accounts; SSO logins are validated by the upstream
identity provider. SSO providers are STORED here but not yet
USED at login time — enforcement lands in a follow-up phase.
object
object
Reject common-password list (“password”, “123456”, …).
0 = passwords never expire.
object
Stable identifier assigned by the admin UI on create.
Empty on a freshly-added provider; the handler fills
it in. Used as OAuth state and as the row key for
later edits.
Per-kind opaque config. For LDAP: server URL, base DN, bind credentials, search filter. For SAML: IdP metadata URL, SP entity ID, certs. For OAuth (Google/GitHub/X): client_id, client_secret, redirect_uri, scopes. Validated at use time by the integration code, not by this endpoint.
object
Self-service signup tunables. Default zero-valued (disabled, verification on, role “Base”) so installs upgrading without opting in stay closed.
object
Master switch. /auth/register returns 403 when false.
When true (recommended), new accounts must click a verification link before they can sign in. Disable only for closed-network installs where outbound SMTP isn’t available.
Role name assigned to fresh signups. Default “Base”. Operators can point this at a more restricted role for moderated communities.
Responses
Section titled “ Responses ”Updated auth config
Authentication + SSO configuration. Persisted under the
sysconfig key auth. The password policy applies only to
local accounts; SSO logins are validated by the upstream
identity provider. SSO providers are STORED here but not yet
USED at login time — enforcement lands in a follow-up phase.
object
object
Reject common-password list (“password”, “123456”, …).
0 = passwords never expire.
object
Stable identifier assigned by the admin UI on create.
Empty on a freshly-added provider; the handler fills
it in. Used as OAuth state and as the row key for
later edits.
Per-kind opaque config. For LDAP: server URL, base DN, bind credentials, search filter. For SAML: IdP metadata URL, SP entity ID, certs. For OAuth (Google/GitHub/X): client_id, client_secret, redirect_uri, scopes. Validated at use time by the integration code, not by this endpoint.
object
Self-service signup tunables. Default zero-valued (disabled, verification on, role “Base”) so installs upgrading without opting in stay closed.
object
Master switch. /auth/register returns 403 when false.
When true (recommended), new accounts must click a verification link before they can sign in. Disable only for closed-network installs where outbound SMTP isn’t available.
Role name assigned to fresh signups. Default “Base”. Operators can point this at a more restricted role for moderated communities.
Malformed request
object
Human-readable error summary
Example
the request could not be completedAuthentication required, missing, or invalid
object
Human-readable error summary
Example
the request could not be completedExample
{ "error": "authentication required: sign in and retry with a valid session or API token"}Authenticated but missing required capabilities
object
Human-readable error summary
Example
the request could not be completed