Overview of authentication in Boundary

An auth method is a resource that establishes the identity of a user who wants to access Boundary. Boundary supports password, OIDC, and LDAP auth methods, each with its own setup and activation steps.

Auth methods contain accounts, which link a set of credentials to an individual user, and managed groups, which group accounts that satisfy criteria you define.

You can configure auth methods at the global or organization scope. Boundary automatically creates a user the first time someone authenticates successfully using a scope's primary auth method.

Auth method types

Boundary supports the following auth method types:

Password: Authenticates users against credentials that Boundary stores and manages directly. Password auth methods do not require an external identity provider.
OIDC: Delegates authentication to an external OpenID Connect provider, such as Auth0, Okta, or Microsoft Entra ID (Azure AD). This method is commonly used for single sign-on (SSO).
LDAP (Lightweight Directory Access Protocol): Authenticates users against an external directory, such as OpenLDAP or Active Directory.

What is a primary auth method?

Each scope has one primary auth method. When a user authenticates successfully with a scope's primary auth method for the first time, Boundary automatically creates a user resource and links it to the resulting account. If a scope's auth method is not primary, an administrator must manually create and link a user to the account before that user can be assigned roles and grants.

Auth method states

OIDC and LDAP auth methods have an operational state that controls whether users can authenticate with them and whether unauthenticated users can see them on the login screen. Boundary creates new OIDC and LDAP auth methods in an inactive state.

inactive: Users cannot authenticate with the auth method, and it is not listed for unauthenticated users.
active-private: Users can authenticate with the auth method, but it is not listed for unauthenticated users.
active-public: Users can authenticate with the auth method, and it is listed for unauthenticated users.

You must activate an OIDC or LDAP auth method before users can log in with it. Password auth methods do not have an operational state and are always available for authentication.

Next steps

To configure an auth method, refer to the following topics:

To learn how to assign permissions to authenticated users, refer to Permissions in Boundary.