Identity
Identity (administrators and Agents)
Administrators
Roles in source: admin, viewer, release_manager, campaign_operator. Most operator APIs still require admin.
Login: username, password, optional two_factor_code. JWT in JSON (token, expires_at, username, role); session cookie HttpOnly not in the body.
2FA setup has no request body (user_id from context). Verify/disable require TOTP/password. Change-password body is old_password + new_password required. See API AUTH.
Default admin from auth.default_admin on first install. Production passwords belong in systemd credentials (Enterprise) — implemented, not final-accepted.
Logout: Enterprise route has no gin auth middleware; Community uses AdminAuth(). Handler still blacklists a valid JWT and clears cookies.
Agents
Pre-register issues a one-time pre-token (security_level standard | maximum for mTLS). Register exchanges it for an Agent JWT (auth.agent_token_ttl example 8h). Reported IP must match effective source on Enterprise.
agents.auto_register example false. Hosting: AGENT_PRE_TOKEN / AGENT_TOKEN via env, then unset. Do not leave pre-tokens in YAML.
Community: 3-Agent cap (COMMUNITY_AGENT_LIMIT_REACHED). Enterprise: license gates.
Token revoke/history APIs exist for admins. Agent POST /api/v1/agents/token/refresh is Agent-facing.
Not in product
OIDC, LDAP, SSO, SAML, SCIM — documentation authority forbids documenting them as shipping.