|
2 | 2 |
|
3 | 3 | Livebook has three levels of authentication: |
4 | 4 |
|
5 | | - * **Instance authentication**: this authenticates the user on all routes of your Livebook instance, including deployed notebooks and the admin section. We provide a variety of authentication options here, including Single Sign On (SSO) and domain-based authentication via [Livebook Teams](https://livebook.dev/teams), as well as Zero Trust Authentication for airgapped environments. See the "Instance authentication" section for more information. |
| 5 | + * **Instance authentication**: this authenticates the user on all routes of your Livebook instance, including deployed notebooks and the admin section. See the "Instance authentication" section for more information. |
6 | 6 |
|
7 | 7 | * **Admin authentication**: this authenticates access to Livebook admin interface within an instance, where users can create, write, and manage notebooks. Both password and token authentication are available. See the ["Admin authentication"](#admin-authentication) section for more information. |
8 | 8 |
|
9 | 9 | * **Deployed notebook passwords**: additionally, when deploying notebooks as applications, each application may be password protected with a unique password. Only users authenticated as admin or with the password will be able to access them. |
10 | 10 |
|
11 | 11 | ## Instance authentication |
12 | 12 |
|
13 | | -When using [Livebook Teams](https://livebook.dev/teams), you can easily deploy instances of Livebook to run as application servers or as development servers. Those instances will, by default, use Livebook Teams to authenticate. The following authentication methods are supported by Livebook Teams: |
| 13 | +You can configure Livebook with different instance authentication mechanisms by setting the `LIVEBOOK_IDENTITY_PROVIDER` provider environment variable. The supported values are: |
14 | 14 |
|
15 | | -* **Livebook Teams account**: allow members of your Livebook Teams organization to authenticate using their Livebook Teams accounts. |
| 15 | + * `basic_auth:<username>:<password>` |
| 16 | + * `cloudflare:<your-team-name (domain)>` |
| 17 | + * `google_iap:<your-audience (aud)>` |
| 18 | + * `tailscale:<tailscale-cli-socket-path>` |
| 19 | + * `custom:YourElixirModule` |
16 | 20 |
|
17 | | -* **Email domain**: allow users to authenticate using email accounts from specific domains, such as your company’s Google Workspace domain. |
18 | | - |
19 | | -* **[OpenID Connect Single Sign-On (SSO)](/oidc_sso.html)**: Allow users to authenticate via an OpenID Connect Single Sign-On provider, such as Okta, Microsoft Entra or Keycloak. |
20 | | - |
21 | | -If your application servers must run in an airgapped environments and cannot reach out to Livebook Teams servers, we also provide a variety of options that can be configured directly in your Dockerfiles. See the "Airgapped Authentication" section in the sidebar. |
| 21 | +See the "Zero Trust Authentication" section in the sidebar. |
22 | 22 |
|
23 | 23 | ## Admin authentication |
24 | 24 |
|
|
0 commit comments