2026-02-24 21:33:15 +00:00
<!doctype html> < html lang = en class = no-js > < head >< meta charset = utf-8 >< meta name = viewport content = "width=device-width,initial-scale=1" >< meta name = description content = "Manage WireGuard Peers and Interface using a beautiful and simple web UI." >< link href = https://wgportal.org/master/documentation/usage/authentication/ rel = canonical >< link href = ../backends/ rel = prev >< link href = ../user-sync/ rel = next >< link rel = icon href = ../../../assets/images/favicon-large.png >< meta name = generator content = "mkdocs-1.6.1, mkdocs-material-9.7.3" >< title > Authentication - WireGuard Portal</ title >< link rel = stylesheet href = ../../../assets/stylesheets/main.484c7ddc.min.css >< link rel = stylesheet href = ../../../assets/stylesheets/palette.ab4e12ef.min.css >< link rel = stylesheet href = ../../../stylesheets/extra.css >< link rel = stylesheet href = ../../../stylesheets/img-comparison-slider.css >< script > __md_scope = new URL ( "../../.." , location ), __md_hash = e =>[... e ]. reduce ((( e , _ )=>( e << 5 ) - e + _ . charCodeAt ( 0 )), 0 ), __md_get = ( e , _ = localStorage , t = __md_scope )=> JSON . parse ( _ . getItem ( t . pathname + "." + e )), __md_set = ( e , _ , t = localStorage , a = __md_scope )=>{ try { t . setItem ( a . pathname + "." + e , JSON . stringify ( _ ))} catch ( e ){}}</ script >< meta property = og:type content = website >< meta property = og:title content = "Authentication - WireGuard Portal" >< meta property = og:description content = "Manage WireGuard Peers and Interface using a beautiful and simple web UI." >< meta property = og:image content = https://wgportal.org/master/assets/images/social/documentation/usage/authentication.png >< meta property = og:image:type content = image/png >< meta property = og:image:width content = 1200 >< meta property = og:image:height content = 630 >< meta content = https://wgportal.org/master/documentation/usage/authentication/ property = og:url >< meta property = twitter:card content = summary_large_image >< meta property = twitter:title content = "Authentication - WireGuard Portal" >< meta property = twitter:description content = "Manage WireGuard Peers and Interface using a beautiful and simple web UI." >< meta property = twitter:image content = https://wgportal.org/master/assets/images/social/documentation/usage/authentication.png ></ head > < body dir = ltr data-md-color-scheme = default data-md-color-primary = white data-md-color-accent = indigo > < input class = md-toggle data-md-toggle = drawer type = checkbox id = __drawer autocomplete = off > < input class = md-toggle data-md-toggle = search type = checkbox id = __search autocomplete = off > < label class = md-overlay for = __drawer ></ label > < div data-md-component = skip > < a href = #password-authentication class = md-skip > Skip to content </ a > </ div > < div data-md-component = announce > </ div > < div data-md-color-scheme = default data-md-component = outdated hidden > </ div > < header class = md-header data-md-component = header > < nav class = "md-header__inner md-grid" aria-label = Header > < a href = ../../.. title = "WireGuard Portal" class = "md-header__button md-logo" aria-label = "WireGuard Portal" data-md-component = logo > < img src = ../../../assets/images/logo.svg alt = logo > </ a > < label class = "md-header__button md-icon" for = __drawer > < svg xmlns = http://www.w3.org/2000/svg viewbox = "0 0 24 24" >< path d = "M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z" /></ svg > </ label > < div class = md-header__title data-md-component = header-title > < div class = md-header__ellipsis > < div class = md-header__topic > < span class = md-ellipsis > WireGuard Portal </ span > </ div > < div class = md-header__topic data-md-component = header-topic > < span class = md-ellipsis > Authentication </ span > </ div > </ div > </ div > < label class = "md-header__button md-icon" for = __search > < svg xmlns = http://www.w3.org/2000/svg viewbox = "0 0 24 24" >< path d = "M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5" /></ svg > </ label > < div class = md-search data-md-component = search role = dialog > < label class = md-search__overlay for = __search ></ label > < div class = md-search__inner role = search > < form class = md-search__form name = search > < input type = text class = md-search__input name = query aria-label = Search placeholder = Search autocapitalize = off auto
2026-01-21 21:23:15 +00:00
< span class = w > </ span >< span class = nt > oidc</ span >< span class = p > :</ span >
< span class = w > </ span >< span class = "p p-Indicator" > -</ span >< span class = w > </ span >< span class = nt > provider_name</ span >< span class = p > :</ span >< span class = w > </ span >< span class = s > " oidc1" </ span >
< span class = w > </ span >< span class = c1 > # ... other settings</ span >
< span class = w > </ span >< span class = nt > allowed_domains</ span >< span class = p > :</ span >
< span class = w > </ span >< span class = "p p-Indicator" > -</ span >< span class = w > </ span >< span class = s > " outlook.com" </ span >
</ code ></ pre ></ div > < h4 id = limit-login-to-existing-users > Limit Login to Existing Users</ h4 > < p > You can limit the login to existing users only by setting the < code > registration_enabled</ code > property to < code > false</ code > for OAuth2 or OIDC providers. If registration is enabled, new users will be created in the database when they log in for the first time.</ p > < h4 id = admin-mapping > Admin Mapping</ h4 > < p > You can map users to admin roles based on their attributes in the OAuth2 or OIDC provider. To do this, set the < code > admin_mapping</ code > property for the provider. Administrative access can either be mapped by a specific attribute or by group membership.</ p > < p >< strong > Attribute specific mapping</ strong > can be achieved by setting the < code > admin_value_regex</ code > and the < code > is_admin</ code > property. The < code > admin_value_regex</ code > property is a regular expression that is matched against the value of the < code > is_admin</ code > attribute. The user is granted admin access if the regex matches the attribute value.</ p > < p > Example: < div class = highlight >< pre >< span ></ span >< code >< span class = nt > auth</ span >< span class = p > :</ span >
< span class = w > </ span >< span class = nt > oidc</ span >< span class = p > :</ span >
< span class = w > </ span >< span class = "p p-Indicator" > -</ span >< span class = w > </ span >< span class = nt > provider_name</ span >< span class = p > :</ span >< span class = w > </ span >< span class = s > " oidc1" </ span >
< span class = w > </ span >< span class = c1 > # ... other settings</ span >
< span class = w > </ span >< span class = nt > field_map</ span >< span class = p > :</ span >
< span class = w > </ span >< span class = nt > is_admin</ span >< span class = p > :</ span >< span class = w > </ span >< span class = s > " wg_admin_prop" </ span >
< span class = w > </ span >< span class = nt > admin_mapping</ span >< span class = p > :</ span >
< span class = w > </ span >< span class = nt > admin_value_regex</ span >< span class = p > :</ span >< span class = w > </ span >< span class = s > " ^true$" </ span >
</ code ></ pre ></ div > The example above will grant admin access to users with the < code > wg_admin_prop</ code > attribute set to < code > true</ code > .</ p > < p >< strong > Group membership mapping</ strong > can be achieved by setting the < code > admin_group_regex</ code > and < code > user_groups</ code > property. The < code > admin_group_regex</ code > property is a regular expression that is matched against the group names of the user. The user is granted admin access if the regex matches any of the group names.</ p > < p > Example: < div class = highlight >< pre >< span ></ span >< code >< span class = nt > auth</ span >< span class = p > :</ span >
< span class = w > </ span >< span class = nt > oidc</ span >< span class = p > :</ span >
< span class = w > </ span >< span class = "p p-Indicator" > -</ span >< span class = w > </ span >< span class = nt > provider_name</ span >< span class = p > :</ span >< span class = w > </ span >< span class = s > " oidc1" </ span >
< span class = w > </ span >< span class = c1 > # ... other settings</ span >
< span class = w > </ span >< span class = nt > field_map</ span >< span class = p > :</ span >
< span class = w > </ span >< span class = nt > user_groups</ span >< span class = p > :</ span >< span class = w > </ span >< span class = s > " groups" </ span >
< span class = w > </ span >< span class = nt > admin_mapping</ span >< span class = p > :</ span >
< span class = w > </ span >< span class = nt > admin_group_regex</ span >< span class = p > :</ span >< span class = w > </ span >< span class = s > " ^the-admin-group$" </ span >
</ code ></ pre ></ div > The example above will grant admin access to users who are members of the < code > the-admin-group</ code > group.</ p > < h2 id = ldap-authentication > LDAP Authentication</ h2 > < p > WireGuard Portal supports LDAP authentication. You can use any LDAP server that supports the LDAP protocol, such as Active Directory or OpenLDAP. Multiple LDAP servers can be configured in the < a href = ../../configuration/overview/#auth >< code > auth</ code ></ a > section of the configuration file. WireGuard Portal remembers the authentication provider of the user and therefore avoids conflicts between multiple LDAP providers.</ p > < p > To configure LDAP authentication, create a new < a href = ../../configuration/overview/#ldap >< code > ldap</ code ></ a > authentication provider in the < a href = ../../configuration/overview/#auth >< code > auth</ code ></ a > section of the configuration file.</ p > < h3 id = limiting-login-to-specific-users > Limiting Login to Specific Users</ h3 > < p > You can limit the login to specific users by setting the < code > login_filter</ code > property for LDAP provider. This filter uses the LDAP search filter syntax. The username can be inserted into the query by placing the < code > {{login_identifier}}</ code > placeholder in the filter. This placeholder will then be replaced with the username entered by the user during login.</ p > < p > For example, if you want to allow only users with the < code > objectClass</ code > attribute set to < code > organizationalPerson</ code > to log in, set the property as follows:</ p > < div class = highlight >< pre >< span ></ span >< code >< span class = nt > auth</ span >< span class = p > :</ span >
< span class = w > </ span >< span class = nt > ldap</ span >< span class = p > :</ span >
< span class = w > </ span >< span class = "p p-Indicator" > -</ span >< span class = w > </ span >< span class = nt > provider_name</ span >< span class = p > :</ span >< span class = w > </ span >< span class = s > " ldap1" </ span >
< span class = w > </ span >< span class = c1 > # ... other settings</ span >
< span class = w > </ span >< span class = nt > login_filter</ span >< span class = p > :</ span >< span class = w > </ span >< span class = s > " (& (objectClass=organizationalPerson)(uid={{login_identifier}}))" </ span >
</ code ></ pre ></ div > < p > The < code > login_filter</ code > should always be designed to return at most one user.</ p > < h3 id = limit-login-to-existing-users_1 > Limit Login to Existing Users</ h3 > < p > You can limit the login to existing users only by setting the < code > registration_enabled</ code > property to < code > false</ code > for LDAP providers. If registration is enabled, new users will be created in the database when they log in for the first time.</ p > < h3 id = admin-mapping_1 > Admin Mapping</ h3 > < p > You can map users to admin roles based on their group membership in the LDAP server. To do this, set the < code > admin_group</ code > and < code > memberof</ code > property for the provider. The < code > admin_group</ code > property defines the distinguished name of the group that is allowed to log in as admin. All groups that are listed in the < code > memberof</ code > attribute of the user will be checked against this group. If one of the groups matches, the user is granted admin access.</ p > < h2 id = user-synchronization > User Synchronization</ h2 > </ article > </ div > < script > var target = document . getElementById ( location . hash . slice ( 1 )); target && target . name && ( target . checked = target . name . startsWith ( "__tabbed_" ))</ script > </ div > </ main > <!-- Application footer --> < footer class = md-footer > <!-- Further information --> < div class = "md-footer-meta md-typeset" style = "background-color: #fff;" > < div class = "md-footer-meta__inner md-grid" style = "background-color: #fff;" > <!-- Copyright and theme information --> < div class = md-footer-copyright > < div class = md-footer-copyright__highlight style = "color: rgb(38, 38, 38);" > Copyright © 2023-2025 WireGuard Portal Project </ div > < div style = "color: rgb(38, 38, 38);" > Made with < a href = https://squidfunk.github.io/mkdocs-material/ target = _blank rel = noopener style = "color: black;" > Material for MkDocs </ a > </ div > </ div > <!-- Social links --> < div class = md-social > < a href = https://github.com/h44z/wg-portal target = _blank rel = noopener title = github.com class = md-social__link > < svg xmlns = http://www.w3.org/2000/svg viewbox = "0 0 512 512" > <!-- Font Awesome Free 7.1.0 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2025 Fonticons, Inc.--> < path d = "M202.1 328.7c0 20.9-10.9 55.1-36.7 55.1s-36.7-34.2-36.7-55.1 10.9-55.1 36.7-55.1 36.7 34.2 36.7 55.1M496 278.2c0 31.9-3.2 65.7-17.5 95-37.9 76.6-142.1 74.8-216.7 74.8-75.8 0-186.2 2.7-225.6-74.8-14.6-29-20.2-63.1-20.2-95 0-41.9 13.9-81.5 41.5-113.6-5.2-15.8-7.7-32.4-7.7-48.8 0-21.5 4.9-32.3 14.6-51.8 45.3 0 74.3 9 108.8 36 29-6.9 58.8-10 88.7-10 27 0 54.2 2.9 80.4 9.2 34-26.7 63-35.2 107.8-35.2 9.8 19.5 14.6 30.3 14.6 51.8 0 16.4-2.6 32.7-7.7 48.2 27.5 32.4 39 72.3 39 114.2m-64.3 50.5c0-43.9-26.7-82.6-73.5-82.6-18.9 0-37 3.4-56 6-14.9 2.3-29.8 3.2-45.1 3.2-15.2 0-30.1-.9-45.1-3.2-18.7-2.6-37-6-56-6-46.8 0-73.5 38.7-73.5 82.6 0 87.8 80.4 101.3 150.4 101.3h48.2c70.3 0 150.6-13.4 150.6-101.3m-82.6-55.1c-25.8 0-36.7 34.2-36.7 55.1s10.9 55.1 36.7 55.1 36.7-34.2 36.7-55.1-10.9-55.1-36.7-55.1" /></ svg > </ a > < a href = https://hub.docker.com/r/wgportal/wg-portal target = _blank rel = noopener title = hub.docker.com class = md-social__link > < svg xmlns = http://www.w3.org/2000/svg viewbox = "0 0 640 512" > <!-- Font Awesome Free 7.1.0 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2025 Fonticons, Inc.--> < path d = "M349.9 236.3h-66.1v-59.4h66.1zm0-204.3h-66.1v60.7h66.1zm78.2 144.8H362v59.4h66.1zm-156.3-72.1h-66.1v60.1h66.1zm78.1 0h-66.1v60.1h66.1zm276.8 100c-14.4-9.7-47.6-13.2-73.1-8.4-3.3-24-16.7-44.9-41.1-63.7l-14-9.3-9.3 14c-18.4 27.8-23.4 73.6-3.7 103.8-8.7 4.7-25.8 11.1-48.4 10.7H2.4c-8.7 50.8 5.8 116.8 44 162.1 37.1 43.9 92.7 66.2 165.4 66.2 157.4 0 273.9-72.5 328.4-204.2 21.4.4 67.6.1 91.3-45.2 1.5-2.5 6.6-13.2 8.5-17.1zm-511.1-27.9h-66v59.4h66.1v-59.4zm78.1 0h-66.1v59.4h66.1zm78.1 0h-66.1v59.4h66.1zm-78.1-72.1h-66.1v60.1h66.1z" /></ svg > </ a > < a href = https://twitter.com/chris_h44z target = _blank rel = noopener titl
