Authentication Overview

Concourse supports three authentication methods. They can be used simultaneously.

Methods

Method	Use case	Configuration
Password	Default. Simple setup.	Enabled by default.
OIDC	Google, Okta, Azure AD, Auth0, or any OIDC-compliant provider.	Set auth.oidc.enabled: true and provider details.
SAML	Enterprise SSO with SAML 2.0 (Okta, Azure AD, OneLogin, PingFederate).	Set auth.saml.enabled: true and IdP metadata.

All methods issue a JWT token on successful authentication. The inboard app includes this token in subsequent API requests as Authorization: Bearer <token>.

Bootstrap admin

On first startup, Concourse creates an admin user from the CONCOURSE_ADMIN_EMAIL and CONCOURSE_ADMIN_PASSWORD environment variables. This user can log in with password auth and has full administrative access.

docker run -d --name concourse \
  -p 8080:8080 \
  -v concourse-data:/data \
  -e CONCOURSE_JWT_SECRET=your-secret-at-least-32-bytes-long \
  -e CONCOURSE_ADMIN_EMAIL=admin@example.com \
  -e CONCOURSE_ADMIN_PASSWORD=changeme \
  ghcr.io/inboard-ai/concourse:latest

After initial setup, change the admin password through the admin panel or the API.

User roles

Role	Description
admin	Full access. Can manage users, relays, agents, and all resources.
member	Standard access. Can use workspaces, boards, and connections.

Users created via SSO (OIDC or SAML) are auto-provisioned with the member role. Admins can promote users afterward.

Attribute mapping

See Attribute Mapping for how Concourse extracts user information from SSO assertions.