Users and Authentication

This section covers the full identity and access management (IAM) surface of Kuboard V4: account login, security policies, organization and authorization model, and integration with external identity providers (IdPs).

Section	Content	When to Read
Login	Account login, first-time setup, forgotten password, session persistence	First login and daily use
Password Policy	Password complexity, expiry, history and lockout policy	Raise the account security baseline
MFA	TOTP (Time-based One-Time Password) two-step verification	Add a second factor for admin accounts
Access Keys	Creating, revoking and scoping API credentials	AI agents, MCP integration, scripted workflows
Users	Creating, disabling, deleting and managing user accounts	Maintain the account roster
Groups	Creating user groups and managing members	Bulk authorization by team or department
Roles	Roles, authorization rules, mapping to K8s RBAC	Design who-can-do-what
OIDC SSO	OIDC (OpenID Connect) integration with Keycloak / Authing / Feishu and more	Enterprise single sign-on
Webhook External User Library	Bridge Kuboard to LDAP or a custom account system via Webhook	Reuse an existing identity backend

Recommended Reading Order

First login — start with Login, then follow Password Policy to change the default password;
Security hardening — enable MFA on every administrator account;
Multi-user collaboration — maintain accounts through Users and Groups, then authorize them with Roles;
Automation integration — issue Access Keys so automated scripts and AI agents gain scoped API access;
Enterprise identity — connect to OIDC or an in-house IdP through OIDC SSO or Webhook External User Library.

Who should read this section

Cluster users (developers, SREs) only need Login, Password Policy and Access Keys;
Kuboard administrators should read the whole section, with extra focus on Roles and the external identity options;
Security and compliance leads should pay close attention to Password Policy, MFA and OIDC SSO.