#Authentication & Users

Ivory runs with or without authentication — the initial setup wizard asks which. Locally you usually don't need it; on a shared VM it is recommended.

#Sign-in Methods

Ivory needs the profile or email scope from an SSO provider to identify a person. Client secrets and LDAP credentials are encrypted with your secret word before they are stored, so it is safe to give them to Ivory.

#Registration Gates Sign-in

Whichever method you switch on, everybody who signs in is an Ivory user first. From the User Manager on the Settings page you register a username and pick which of the three ways that person may sign in with. A name your directory knows but Ivory does not is refused — so an unexpected LDAP or SSO account cannot walk in under a name somebody else holds.

Nobody ever types somebody else's password. Registering somebody for basic auth issues a one-time link instead: the person opens it, sets their own password, and is signed in straight away. The link works once, expires after 12 hours, and can be revoked at any time — hand it only to the person it names.

The superuser who sets Ivory up is the one exception: their password is typed during the initial setup, since there is nobody yet to send a link to.

#Staying Signed In

Signing in gives the browser a session that lasts one hour. While you keep working, Ivory renews it in the background once it is past its first half, so an active session never logs you out; between half an hour and an hour of inactivity does. Each renewal checks again that you are still registered for the way you signed in, so a user deleted or barred from that method stops being renewed.

A session is not stored anywhere, so it cannot be ended remotely: deleting a user, changing a password or signing out elsewhere leaves a session already issued valid until it expires unused. Tokens for AI agents work differently — they last as long as you chose and are never renewed, see MCP server.

#Superusers

A superuser always holds every permission and cannot have any of them taken away, which is what guarantees Ivory stays administrable. Only a superuser can register, change, reset or delete another superuser, and there is always at least one — the last one cannot be deleted. Nobody can delete themselves.

#What Can and Cannot Change

• A username is never changed, and the superuser flag is never taken back.
• What you can change about an existing user is which ways they sign in.
• The single thing a person can change about themselves is their own password, from the same User Manager, proven by the current one.
• Deleting a user removes their permissions too.

#Forgotten Passwords

From the User Manager you reset the person's password, which hands them a new one-time link. The user and everything granted to it are kept, and the password they already have keeps working until they use the link — a reset is an offer, not a lockout. Only a superuser can reset a superuser's password.

#Permissions

Ivory has a granular permission system — view or manage clusters, execute queries, manage configurations, deploy containers, read node metrics, and so on. Permissions are managed per user from the Permission Manager on the Settings page once authentication is enabled.

#Running Without Authentication

Running Ivory without authentication switches all of this off: there is no account to change and nobody to grant anything to, so neither the User Manager nor the Permission Manager is offered at all, and every action is permitted.