Skip to content
DiscVaultDiscVault Docs

Configure: Authentication and RBAC

Goal and result

Section titled “Goal and result”

Operate Passkeys and RBAC in both channels, and manage optional Legacy Authentication users and recovery in DiscVault 26 beta.

Applies to

Section titled “Applies to”

DiscVault v26 provides WebAuthn and RBAC in stable and beta. A passkey keeps its private key on the device or in a trusted credential manager while DiscVault stores the public key. DiscVault 26 beta additionally supports the opt-in Legacy Authentication capability. Owners and Admins can issue temporary passwords, require a password change, set per-user MFA policy, and control passkey registration. TOTP secrets are encrypted and unified recovery codes are hashed and single-use.

DiscVault v26 stable

Section titled “DiscVault v26 stable”
  • DiscVault v26 stable · ghcr.io/helmerznl/discvault:latest
  • WebAuthn · owner / administrator / editor / fan / viewer
  • a passkey is a cryptographic key pair: the private key stays on the device or in a trusted credential manager, and DiscVault stores only the public key

DiscVault v26 beta

Section titled “DiscVault v26 beta”
  • DiscVault v26 beta · ghcr.io/helmerznl/discvault:beta
  • WebAuthn + optional Legacy Authentication
  • temporary passwords · forced password change · TOTP · recovery codes

Prerequisites

Section titled “Prerequisites”

Procedure

Section titled “Procedure”
  1. Inspect: a passkey is a cryptographic key pair: the private key stays on the device or in a trusted credential manager, and DiscVault stores only the public key
  2. Compare: passkeys are phishing-resistant and unique to the site; sign-in uses the device unlock method instead of a reusable account password · a time-limited invite code starts registration but is not a reusable account password; normal sign-in uses a passkey
  3. Verify: Windows needs a current passkey-capable browser and Windows Hello with at least a PIN; Windows 11 22H2 or newer is recommended for native passkey management
  4. Verify: macOS needs Ventura 13 or newer with iCloud Keychain, or another passkey-capable credential manager
  5. Verify: iPhone and iPad need iOS or iPadOS 16+ with iCloud Keychain and two-factor authentication; Android needs version 9+ with a passkey provider and screen lock
  6. Create: register more than one passkey, such as a phone and a desktop device, and keep an independent owner recovery path before replacing or losing a device
  7. Open: Admin → Security → Enable authentication
  8. Create: Admin → Users → Create 48-hour invite
  9. Configure: Admin → Roles → Basic / Advanced
  10. Configure: on an existing installation, enable password login in Users & roles and approve activation with a fresh Owner or Admin passkey assertion · Owners and Admins can issue temporary passwords, require a password change, set per-user MFA policy, and control passkey registration
  11. Record: recovery codes are hashed, single-use, and shared with passkey recovery; backups omit TOTP secrets and recovery material, so MFA users enroll again after restore · disabling Legacy Authentication requires an active Owner passkey; a local-IP-only Owner must establish a valid FQDN and Owner passkey before safe disablement
  12. Test: second user · assigned permission only · owner session remains open

Commands and settings

Section titled “Commands and settings”

DiscVault v26 stable

Section titled “DiscVault v26 stable”
Terminal window
curl --fail http://localhost:6080/api/next/auth/status
curl --fail http://localhost:6080/api/next/auth/rbac

DiscVault v26 beta

Section titled “DiscVault v26 beta”
Terminal window
curl --fail http://localhost:6180/api/next/auth/status
curl --fail http://localhost:6180/api/next/auth/rbac

Expected result

Section titled “Expected result”

Owner login retains two recovery-capable passkeys, beta password users receive the intended TOTP and password policy, and a test user receives only assigned permissions.

  • owner passkey login works, invite-only registration matches the setting, and the test user has only assigned permissions
  • passkeys are phishing-resistant and unique to the site; sign-in uses the device unlock method instead of a reusable account password
  • a time-limited invite code starts registration but is not a reusable account password; normal sign-in uses a passkey

Safety and rollback

Section titled “Safety and rollback”

Next step

Section titled “Next step”

Configure: Plugins and metadata

Source and status

Section titled “Source and status”