Accounts and sign-in

Two ways in

Janus accepts sign-in from a corporate identity provider (OIDC — Entra ID, Okta, Google, Authentik, Keycloak…) and from Janus accounts held by the gateway itself: email, password and an optional authenticator-app second factor. Both create the same kind of user, so seats, roles, teams, grants and audit are identical.

Without an identity provider configured, the very first visit to a new gateway shows “Create the first administrator”. That endpoint disappears once any account exists; every later account is created by an administrator under Administration → People → Add user.

Passwords and lockout

Passwords are 12–128 characters with no composition rules (a sentence is a good password) and are stored as salted PBKDF2-HMAC-SHA-512 hashes (400,000 iterations; accounts created by older releases move from bcrypt to PBKDF2 automatically at their next sign-in). Ten wrong attempts in a row lock the account for 15 minutes, and the form then says so. Otherwise a wrong email and a wrong password give the same answer, so the sign-in form cannot be used to discover accounts. Each network address may try to sign in 20 times a minute. Changing a password signs out every other session.

Administrators create accounts and reset passwords with a temporary password the person must replace at their next sign-in. Administrators never see or set a permanent password.

Two-factor authentication

Two-factor protects a Janus password, so set a password first. Sign-in through an identity provider relies on that provider’s own two-factor, and directory passwords are not covered. Personal settings → Security → Set up shows a QR code for any TOTP app. Enrollment completes only after a correct code, and issues ten single-use recovery codes shown once. Secrets are encrypted at rest with the gateway key. Turning two-factor off yourself asks for your password. An administrator can remove a user’s second factor from Administration → People when a device is lost.

Several identity providers (Business)

Administration → Settings → Sign-in & provisioning → Identity providers adds OIDC providers beside the environment-configured one: a contractor tenant in Entra ID next to the corporate Okta, or Google Workspace for a subsidiary. Each provider has a slug that becomes its callback URL (/auth/callback/<slug>) — register that URL at the provider — and its own sign-in button.

Test checks discovery before you save. The client secret is encrypted at rest and never shown again. ID tokens must be signed with RS256/384/512 or ES256/384/512 — Authentik in particular defaults new providers to HS256 until a signing key is selected; Janus refuses HS256 with an explicit message. Per-provider admin groups are re-evaluated at every sign-in and combine with JANUS_ADMIN_GROUPS. Subjects are namespaced by slug, so two providers can never collide on the same user id. Deleting a provider keeps the accounts it created; those people need another way in.

Directory sign-in — LDAP and Active Directory (Business)

Administration → Settings → Sign-in & provisioning → Directory (LDAP / Active Directory) connects one LDAP directory. People type their directory email and password into the same sign-in form Janus accounts use; Janus looks the person up with the service account, binds as them to prove the password, reads their groups, and creates the account on first sign-in. Admin groups are re-evaluated at every sign-in and combine with JANUS_ADMIN_GROUPS.

Use ldaps:// wherever possible. The service-account password is encrypted at rest and never shown again. The user filter receives the typed login (escaped, so nothing a user types can widen the search); the Active Directory default matches mail, UPN or sAMAccountName. Test resolves a login without its password and shows the DN, groups and whether that person would be an administrator — check this before enabling.

A wrong directory password answers exactly like a wrong Janus-account password. If the directory is unreachable the form says so (HTTP 503) instead of pretending the password was wrong, and Janus-account passwords keep working — an admin with a break-glass password can always get in. Local accounts are checked first, so a person can hold both.

Break-glass

An SSO user — typically an administrator — can add a password under Personal settings → Security. When the identity provider is unreachable the sign-in page still offers the password form, so the gateway can be administered during an IdP outage. Protect such accounts with two-factor authentication.

Evaluation sign-in

JANUS_DEV_AUTH=true (any email signs in, no password) remains for laptops and demos only. The gateway refuses to start with it when JANUS_ENV=production is set explicitly, or when JANUS_PUBLIC_URL is not localhost or a loopback address (the check that protects a deployment left with JANUS_ENV unset). With local accounts available there is no longer a reason to run it on a shared gateway.