Dashboard authentication

The Dashboard authenticates every person who signs in, and you decide how - with the built-in accounts alone or with Microsoft Entra ID single sign-on on top of them. The Zato_Dashboard_Auth_Type environment variable selects the type:

Built-in accounts keep working in every authentication type - enabling Entra ID adds a second way to sign in, and local admin accounts stay reachable at all times.

Built-in accounts

Built-in authentication is the default and requires no configuration. A container creates an admin account, and you set its password with Zato_Dashboard_Password - see the environment variable reference.

The login page shows a username and password form.

Microsoft Entra ID

With Zato_Dashboard_Auth_Type=entra, the login page shows a "Sign in with Microsoft" button above the built-in form. The button starts an OpenID Connect flow with Microsoft Entra ID and, for users already signed in to their Windows domain, the sign-in completes silently, without any prompts.

The Dashboard creates an account for each person on their first sign-in. Such accounts have no local password and their access follows Entra ID group membership:

• Members of an admin group can log in as Dashboard administrators
• Everyone else is rejected

Environment variables

For example:

export Zato_Dashboard_Auth_Type=entra
export Zato_Dashboard_Auth_Entra_Tenant_Id=7c1b32a4-2d5e-4f8a-9b3c-6e1d0a842f95
export Zato_Dashboard_Auth_Entra_Client_Id=e94f2d81-63b7-4c5a-8f2e-1a9d7b3c4e60
export Zato_Dashboard_Auth_Entra_Client_Secret=...
export Zato_Dashboard_Auth_Entra_Redirect_URL=https://dashboard.example.com/accounts/login/callback/
export Zato_Dashboard_Auth_Entra_Group_Admin=9d7c5b3a-8e6f-4a2b-9c1d-3e5f7a9b1c2d

App registration in Entra ID

Register the Dashboard as a web application in the Microsoft Entra admin center:

1. Go to Identity → Applications → App registrations and create a new registration
2. Under Authentication, add a Web platform with the redirect URI pointing to your Dashboard's /accounts/login/callback/ address - the same value as Zato_Dashboard_Auth_Entra_Redirect_URL
3. Under Certificates and secrets, create a client secret and use its value as Zato_Dashboard_Auth_Entra_Client_Secret
4. Under Token configuration, add a groups claim so that ID tokens include the group membership - select "Security groups" with the group ID format
5. Copy the directory (tenant) ID and the application (client) ID from the Overview page

You find the group object IDs for Zato_Dashboard_Auth_Entra_Group_Admin under Identity → Groups - each group's Overview page shows its object ID.

Auto-login

With Zato_Dashboard_Auth_Entra_Auto_Login=true, opening the Dashboard sends the browser straight to Microsoft, skipping the login page entirely. For users with an active Entra ID session this means the Dashboard opens with no interaction at all.

The same applies to signing out - with auto-login on, logging out of the Dashboard sends the browser back to Microsoft, which signs the user straight back in for as long as their Entra ID session lasts. You end access for a person in Entra ID, by removing them from the admin group, not by signing them out of the Dashboard.

Log in with a built-in account when Entra ID is enabled

The plain username and password form is always available at:

https://dashboard.example.com/accounts/login/?auth=built-in

The form works in every configuration, including with auto-login turned on, so local admin accounts can always log in - for example, when the identity provider is not available.

The OpenAPI console

The OpenAPI console shares the Dashboard's authentication:

• Admins sign in to the console with the same credentials as the Dashboard admin and receive the full OpenAPI document with complete try-it access.
• With Entra ID enabled, the console reads the same Zato_Dashboard_Auth_Type and Zato_Dashboard_Auth_Entra_* variables, so configuring Entra ID once covers both applications. Every Entra ID user is an administrator, in the Dashboard and the console alike.

The one console-specific variable is the redirect URL, because Entra ID requires an exact match per application:

export Zato_OpenAPI_Console_Auth_Entra_Redirect_URL=https://api-console.example.com/openapi/console/login/callback

Add that address as one more redirect URI in the same app registration and nothing else changes.

See also

Learn more