Summary
Enhance the auth sources overview to clearly separate UI-login authentication from NAS domain join, and document that authenticating VergeOS UI/tenant logins against Windows Active Directory is done by federating on-prem AD through an OIDC identity provider (Entra ID, Okta, etc.) — VergeOS does not provide a native LDAP auth-source driver.
Type
Conceptual / How-to Guide
Target Page
docs/product-guide/auth/auth-sources-general.md — ENHANCE with a disambiguation section separating UI-login auth sources from NAS domain join, and a clear statement of the supported AD-login path.
Proposed Content
UI Login Authentication vs. NAS Domain Join
VergeOS has two separate features that both involve Active Directory, and they are frequently confused:
| Feature |
Purpose |
Where configured |
| Auth source (UI login) |
Allows VergeOS UI users and tenant users to log in with external identity provider credentials |
System → Auth Sources |
| NAS domain join |
Joins the VergeOS NAS service to an AD domain for CIFS/SMB file-share access control |
NAS → Domain |
These are independent. Joining a NAS domain does not enable AD-backed UI login, and configuring a UI auth source does not affect NAS file-share permissions.
Authenticating UI Logins Against Windows AD
VergeOS UI and tenant login auth sources are OAuth2/OIDC based:
- Azure Active Directory / Entra ID
- Okta
- Google Workspace
- GitLab
- Generic OIDC provider
VergeOS does not provide a native (local) LDAP auth-source driver — there is no direct LDAP/AD bind option for UI login. To let Windows domain users log into the VergeOS UI with their AD credentials, federate on-prem AD through Azure AD / Entra ID (or another OIDC-compatible identity provider) and configure an OIDC auth source in VergeOS. Group membership from the IdP can be mapped to VergeOS groups so permissions follow the directory.
Context
- Audience: admins
- Verified: VergeOS does not ship a local/native LDAP auth source (confirmed by product owner). The documented and supported external auth source type is OAuth2/OIDC. NAS domain join is a distinct feature (SMB/CIFS file sharing) and does not affect UI login.
- Recurring support topic: customers repeatedly ask how to let Windows AD users log into the VergeOS UI or a tenant; they find the NAS domain join docs and assume that covers UI login, or they look for an LDAP auth source that does not exist.
- Source: VergeBot chatlogs (no associated Salesforce case)
Summary
Enhance the auth sources overview to clearly separate UI-login authentication from NAS domain join, and document that authenticating VergeOS UI/tenant logins against Windows Active Directory is done by federating on-prem AD through an OIDC identity provider (Entra ID, Okta, etc.) — VergeOS does not provide a native LDAP auth-source driver.
Type
Conceptual / How-to Guide
Target Page
docs/product-guide/auth/auth-sources-general.md— ENHANCE with a disambiguation section separating UI-login auth sources from NAS domain join, and a clear statement of the supported AD-login path.Proposed Content
UI Login Authentication vs. NAS Domain Join
VergeOS has two separate features that both involve Active Directory, and they are frequently confused:
These are independent. Joining a NAS domain does not enable AD-backed UI login, and configuring a UI auth source does not affect NAS file-share permissions.
Authenticating UI Logins Against Windows AD
VergeOS UI and tenant login auth sources are OAuth2/OIDC based:
VergeOS does not provide a native (local) LDAP auth-source driver — there is no direct LDAP/AD bind option for UI login. To let Windows domain users log into the VergeOS UI with their AD credentials, federate on-prem AD through Azure AD / Entra ID (or another OIDC-compatible identity provider) and configure an OIDC auth source in VergeOS. Group membership from the IdP can be mapped to VergeOS groups so permissions follow the directory.
Context