Authentication

This section describes how users sign in to InfluxDB 3 Explorer. To authenticate API requests and client connections to InfluxDB 3, see Manage tokens.

Explorer uses the users, roles, and authentication methods of the InfluxDB 3 Enterprise server that it connects to. When the server has user authentication turned on, each person signs in to Explorer with their own account.

• When Explorer requires sign-in
• Authentication methods
• Configuration model
• What changes when users sign in
• Sign in
• Sessions

When Explorer requires sign-in

The InfluxDB 3 server determines whether Explorer requires sign-in. Explorer checks the server and follows the configuration of the server.

To turn user authentication on or off, set the --user-auth-type option when you start InfluxDB 3 Enterprise. See Enable user authentication in the InfluxDB 3 Enterprise documentation.

The Explorer Docker container checks the server that you set as DEFAULT_INFLUX_SERVER. If you don’t pre-configure a server, Explorer doesn’t require sign-in. See Pre-configure InfluxDB connections.

The --mode option of the Explorer Docker container doesn’t turn sign-in on or off. It sets whether Explorer runs in query mode or admin mode. To manage users, the Docker container must run in admin mode.

Sign-in requires InfluxDB 3 Explorer v1.11 or later. Use it with InfluxDB 3 Enterprise v3.12 or later, where user authentication is generally available. To check the version and edition of your server, see Check which version applies to you.

Authentication methods

Explorer supports two authentication methods. You can use one method or both. Each method matches a value of the --user-auth-type server option.

To use both methods, set --user-auth-type basic,oauth. The default value is none, which turns user authentication off. For more information, see --user-auth-type in the InfluxDB 3 Enterprise documentation.

Each user signs in with the method that an administrator selects when adding the user: Password, SSO, or Both. For more information, see Manage users.

Configuration model

You configure authentication on the InfluxDB 3 Enterprise server, not in Explorer. See the following in the InfluxDB 3 Enterprise documentation:

• Enable user authentication
• Configure JWT signing keys for password sign-in
• Authenticate with OAuth/OIDC for SSO
• Configure SSO for the Explorer UI for SSO in the integrated Explorer UI

In Explorer, you manage the following:

• Users and their roles. See Manage users.
• The session secret of the Explorer Docker container. See Sessions.
• The SSO settings of the Explorer Docker container. See Configure single sign-on.

What changes when users sign in

When the server requires sign-in, Explorer works differently than it does with a stored token:

• Explorer sends requests to the server as the user who is signed in, not with a stored token.
• Explorer configures the connection to the server for you. Users work with the server that they signed in to, and can’t add other server connections or store tokens.
• Explorer hides the pages and actions that the roles of a user don’t allow.
• Dashboards, saved queries, and query history belong to the user who creates them.

Sign in

If the server doesn’t have any users or an operator token, Explorer opens a setup page instead of the Sign in page. See Set up the first user.

Sign in with a username and password

1. Open Explorer in your browser.
2. On the Sign in page, enter your Username and Password.
3. Click Sign in.

If you opened a link to a specific page, Explorer opens that page after you sign in.

If an administrator requires you to change your password, Explorer opens the Change your password page. See Change a required password.

Sign in with SSO

Before you sign in with SSO, an administrator does the following:

• Configures the InfluxDB 3 Enterprise server to use your identity provider. See Configure SSO for the Explorer UI. For the Explorer Docker container, the administrator also configures the container. See Configure single sign-on.
• Adds a user for you with an OAuth ID that matches the subject (sub) that your identity provider sends.

To sign in:

1. Open Explorer in your browser.
2. On the Sign in page, click Sign in with SSO.
3. Sign in with your identity provider.

Your identity provider returns you to Explorer.

Sessions

Explorer keeps a user signed in for up to 120 days, and extends that time while the user works in Explorer.

Explorer ends a session sooner when any of the following happen:

• The user signs out.
• An administrator deletes the user.
• The session secret changes. A new session secret signs out every user.

To keep users signed in when the server or container restarts, use the same session secret each time:

• For the integrated Explorer UI, see Sessions in the InfluxDB 3 Enterprise documentation.
• For the Docker container, set SESSION_SECRET_KEY. See Environment variables.

When a session ends, Explorer opens the Sign in page. After the user signs in, Explorer returns to the page that the user was working in.