3 ms·

Those auth UX challenges are being worked on: https://github.com/lxc/incus-os/issues/496 https://github.com/lxc/incus-os/issues/496 https://github.com/lxc/inc

by _kb 11mo ago

Those auth UX challenges are being worked on: https://github.com/lxc/incus-os/issues/496 https://github.com/lxc/incus-os/issues/496 https://github.com/lxc/incus-os/issues/497 https://github.com/lxc/incus-os/issues/497 IMO the client certs are pretty elegant from a technical perspective. It works well with the CLI, but the browser experience is different enough to cause at least some base level wtf-ery.

stormking 11mo ago
Elegant, schmellegant. If you want your software to be usable in an enterprise environment, you have to support OIDC out of the box.
- stgraber 11mo ago
  Yeah, most enterprise deployments of Incus use OIDC for authentication and then OpenFGA for authorization with permissions typically synchronized with something like AD/Entra. TLS certs remain used for some role account type stuff and as a break glass type of access for when OIDC is unavailable and there's an emergency. A nice characteristic of TLS certificates is that they can be generated safely in a HSM which you can then dump into a safe, works well in the corporate world, much better than passwords for this kind of thing.