Overview

LGF groups identity, certificate, ingress, and automation controls under Settings > Security. This keeps authentication and externally reachable control-plane features together instead of scattering them across general settings.

Security sections

  • LDAP Authentication configures directory login and LDAP group-to-role mappings.
  • OIDC Authentication (SSO) configures OpenID Connect sign-in and identity claims.
  • Operator Console TLS manages the certificate and key used by the console.
  • Let's Encrypt obtains a certificate for a publicly reachable Operator Console URL. It does not validate the internal .local hostname.
  • Air Traffic Control configures host registration and cloud/control-plane integration.
  • Cloud Automation configures automation endpoints and credentials used for authorized host or bench operations.

Certificate guidance

Use a public DNS name that resolves to the Operator Console when requesting Let's Encrypt. Internal mDNS or .local names are not publicly valid certificate names. Manual certificate replacement remains available when the public URL cannot use the supported ACME challenge path.

Verification

After saving a security setting, confirm the relevant status card or test action reports success. For TLS changes, open the console through the public URL and verify the certificate name and expiration.

Troubleshooting

LDAP or OIDC users can authenticate but have no access

Authentication and authorization are separate. Confirm the mapped groups or claims and make sure the user is in an allowed role mapping.

Let's Encrypt validation fails

Confirm public DNS, inbound HTTP/HTTPS reachability, the requested URL, and that the URL is not an internal .local name.

The console certificate did not change

Confirm the certificate and key pair match, save the configuration, and reload the Operator Console services. Review the related job output for refusal details.