Operator reference

Basic Auth

Email and password authentication in Nexus

Before you begin

This reference describes the underlying platform. Use a Nexus school release with its school membership, class policy, and cost controls. Installing a base engine alone does not add those controls.

Email/password authentication is always enabled and works out of the box, with no configuration needed. The first user to sign up becomes an admin.

We recommend adding Google OAuth, OIDC, or SAML for production deployments. Once SSO works, password login and sign-up can be turned off entirely.

Versions before v4.4.0 required AUTH_TYPE=basic. Since v4.4.0 the variable is inert and it is planned for full removal in v4.5.

If you have questions about which authentication approach is best for your school, don't hesitate to contact us

we're happy to help you choose the right solution.

Password Requirements#

Passwords must be 8 to 64 characters by default. The length limits and character-class requirements (uppercase, lowercase, number, special character) are configurable at Admin Panel → Organization → Security & Hardening.

Email Verification#

Enabling email verification blocks your users from signing in until they click their verification email.

Using Docker:

Set the following in your .env file:

# Enable email verification
REQUIRE_EMAIL_VERIFICATION=true

# Email configuration
SMTP_USER=<EMAIL_TO_SEND_VERIFICATION_EMAILS_FROM>  # e.g. noreply@yourcompany.com
SMTP_PASS=<PASSWORD_FOR_THE_EMAIL_ABOVE>

# Required for non-Gmail accounts
SMTP_SERVER=<YOUR_SMTP_SERVER>
SMTP_PORT=<PORT_YOUR_SMTP_SERVER_LISTENS_ON>  # default: 587

Using Helm:

Set the following in your values.yaml file:

auth:
secrets:
    smpt_pass: <PASSWORD_FOR_THE_SMTP_USER>
configMap:
REQUIRE_EMAIL_VERIFICATION: true
SMTP_USER: <EMAIL_TO_SEND_VERIFICATION_EMAILS_FROM>

# Required for non-Gmail accounts
SMTP_SERVER: <YOUR_SMTP_SERVER>
SMTP_PORT: <PORT_YOUR_SMTP_SERVER_LISTENS_ON>

Next Steps#

Set up Google OAuth #

Google OAuth is a secure and easy way to authenticate users with their Google accounts.

Other Nexus Configuration Options #

There are many other configuration options available for Nexus.