Users, SSO and two-factor
Updated 2026-09-08 · Pharos 0.5.10
There are two roles. Admin manages users, updates, API tokens, branding, mail templates and the audit log; user works with components, incidents and the status page. The first account is an admin. Login is throttled at five attempts per email and IP with a five-minute lockout. Passwords are at least twelve characters.
You cannot delete the account you are signed in with, and you cannot delete the last account — locking everyone out of a self-hosted install is not recoverable through the interface. There is no password-reset email; recover from the shell:
php artisan pharos:user [email protected] --password='a-new-long-password'
Two-factor
Each user turns on TOTP two-factor for their own account under Profile: scan the QR code with any
authenticator app, confirm one code, and it is on. It is asked for at every sign-in afterwards — including a
sign-in through single sign-on, so a second door never skips the gate. Lost the device? Turn it off for that
account from the shell with php artisan pharos:2fa:disable [email protected].
Single sign-on (OpenID Connect)
Under Settings → Single sign-on you can point Pharos at any OIDC provider — Authentik, Keycloak, Google Workspace, Entra ID. Fill in the issuer URL, client id and secret, register the redirect URI it shows you, and a Sign in with … button appears on the login screen.
People sign in, they do not appear. Someone signing in through your provider needs an account here already, matched on their verified e-mail address; an address nobody here uses is refused, not turned into a new account. Password sign-in keeps working, so a provider that is down never locks you out. The switch is tested the moment you save it — a provider that cannot be reached will not switch on.