Access
SSO, LDAP and two-factor
Three ways to stop maintaining a separate list of passwords, each optional and each configured by an admin.
Single sign-on (OIDC)
| Field | What it is |
|---|---|
| issuer_url | Your identity provider's issuer URL. |
| client_id | The client MangoDock is registered as. |
| client_secret | Stored encrypted; the API only ever reports whether one is set. |
| external_url | The URL users reach MangoDock on, which is what the redirect comes back to. Behind a proxy this is the proxy's address, not the container's. |
| default_role | The role a person gets the first time they sign in this way. |
| button_label | What the sign-in button says. Defaults to “Single sign-on”. |
LDAP and Active Directory
| Field | What it is |
|---|---|
| url | The directory server. |
| bind_dn | The account MangoDock binds as to search. |
| bind_password | Stored encrypted, like every other credential. |
| base_dn | Where to search from. |
| user_filter | Which entries count as users. |
| default_role | The role a directory user gets on first sign-in. |
| button_label | What the sign-in button says. |
Two-factor
Per-user TOTP, enrolled by the user from their own account rather than imposed centrally. Enrolment issues recovery codes; each is single-use and MangoDock tracks how many remain unused, so you find out you are running low before you are locked out.
A TOTP step is claimed once — the same code cannot be replayed within its window. An admin can disable two-factor on another user's account, which is the way back in when someone loses their phone and their recovery codes.
Recovery codes are hashed, not stored
They are kept as SHA-256 rather than in the clear. That is deliberately a fast hash, not a slow one: a recovery code already has enough entropy that the hash only needs to resist lookup from a stolen database, which is a different job from the deliberate slowness of a password hash.
Air-gapped
- Both integrations talk only to the server you name. An internal identity provider or directory works exactly as an external one would.