Basic Authentication | OpenMetadata Security Setup

Out of the box, OpenMetadata comes with a Username & Password Login Mechanism. The default Username and Password for Login are:

Username - admin@open-metadata.org
Password - admin

When using a custom domain, configure the principal domain as follows:

config:
    authorizer:
      adminPrincipals: [admin]
      principalDomain: "yourdomain.com"

With this setup, the default Username will be admin@yourdomain.com.

Security requirements for your production environment:

DELETE the admin default account shipped by OM.
UPDATE the Private / Public keys used for the JWT Tokens in case it is enabled.

Setting up Basic Auth Manually

Below are the required steps to set up the Basic Login:

Set up Configurations in openmetadata.yaml

Authentication Configuration

The following configuration controls the auth mechanism for OpenMetadata. Update the mentioned fields as required.

authenticationConfiguration:
  provider: ${AUTHENTICATION_PROVIDER:-basic}
  publicKeyUrls: ${AUTHENTICATION_PUBLIC_KEYS:-[`{your domain}`/api/v1/system/config/jwks]} # Update with your Domain and Make sure this "/api/v1/system/config/jwks" is always configured to enable JWT tokens
  authority: ${AUTHENTICATION_AUTHORITY:-https://accounts.google.com}
  enableSelfSignup : ${AUTHENTICATION_ENABLE_SELF_SIGNUP:-true}

For the Basic auth we need to set:

provider: basic
publicKeyUrls: {http|https}://{your_domain}:{port}/api/v1/system/config/jwks
authority: {your_domain}
enableSelfSignup: This flag indicates if users can come and signup by themselves on the OM

Authorizer Configuration

This configuration controls the authorizer for OpenMetadata:

authorizerConfiguration:
  adminPrincipals: ${AUTHORIZER_ADMIN_PRINCIPALS:-[admin]}
  allowedEmailRegistrationDomains: ${AUTHORIZER_ALLOWED_REGISTRATION_DOMAIN:-["all"]}
  principalDomain: ${AUTHORIZER_PRINCIPAL_DOMAIN:-"open-metadata.org"}

For the Basic auth we need to set:

adminPrincipals: admin usernames to bootstrap the server with, comma-separated values.
allowedEmailRegistrationDomains: This controls what all domain are allowed for email registration can be your as well, for example gmail.com, outlook.comm etc.
principalDomain: This controls what all domain are allowed for email registration, for example gmail.com, outlook.comm etc. When AUTHORIZER_ENFORCE_PRINCIPAL_DOMAIN is set to true, only users with email addresses from the AUTHORIZER_PRINCIPAL_DOMAIN can log in.

Starting in 2.1, adminPrincipals and principalDomain are deprecated but still work. Use adminEmails to list admins by email address, allowedEmailDomains to restrict sign-in domains, and botDomain for bot email addresses. For more information, see Email-First User Identity.

Please note the following are the formats to bootstrap admins on server startup: [admin1,admin2,admin3]This works for SMTP-enabled servers, Login Password for these are generated randomly and sent to the mail adminName@principalDomain.If SMTP is not enabled for OpenMetadata, please use the method below to create admin users: [admin1, admin2, admin3]. The default password for all admin users will be admin.After logging into the OpenMetadata UI, admin users can change their default password by navigating to Settings > Members > Admins.

Metadata Ingestion

For ingesting metadata when Basic Auth is enabled, it is mandatory to configure the ingestion-bot account with the JWT configuration. To know how to enable it, you can follow the documentation of Enable JWT Tokens.

Setting up SMTP Server

Basic Authentication is successfully set. For a better login experience, we can also set up the SMTP server to allow the users to Reset Password, Account Status Updates, etc. as well.

email:
  emailingEntity: ${OM_EMAIL_ENTITY:-"OpenMetadata"} -> Company Name (Optional)
  supportUrl: ${OM_SUPPORT_URL:-"https://slack.open-metadata.org"} -> SupportUrl (Optional)
  enableSmtpServer : ${AUTHORIZER_ENABLE_SMTP:-false} -> True/False
  senderMail: ${OPENMETADATA_SMTP_SENDER_MAIL:-""} -> Sender's email
  serverEndpoint: ${SMTP_SERVER_ENDPOINT:-""} -> (Ex :- smtp.gmail.com)
  serverPort: ${SMTP_SERVER_PORT:-""} -> (SSL/TLS port)
  username: ${SMTP_SERVER_USERNAME:-""} -> (SMTP Server Username)
  password: ${SMTP_SERVER_PWD:-""} -> (SMTP Server Password)
  transportationStrategy: ${SMTP_SERVER_STRATEGY:-"SMTP_TLS"}

Following are valid value for transportation strategy:

SMTP: If SMTP port is 25 use this
SMTPS: If SMTP port is 465 use this
SMTP_TLS: If SMTP port is 587 use this

Configure Ingestion

Once your server security is set, it’s time to review the ingestion configuration. Our bots support JWT tokens to authenticate to the server when sending requests. Find more information on Enabling JWT Tokens and JWT Troubleshooting to ensure seamless authentication.

Recover Access During an SSO Outage

OpenMetadata cannot use Basic Auth and single sign-on (SSO) at the same time. During an SSO outage, an operator with access to the OpenMetadata deployment can temporarily switch the server to Basic Auth.

Prepare and test a Basic Auth administrator account before an outage. Switching providers does not create a usable password for an existing SSO-only account. Changing the provider also invalidates sessions created by the previous provider. Restarting or rolling out the OpenMetadata server can briefly interrupt access.

To recover access:

Confirm that you have deployment access and a tested Basic Auth administrator credential.
Record the current SSO provider and configuration so you can restore them. Open Settings > SSO and save the current values, or back up the authenticationConfiguration and authorizerConfiguration entries in the openmetadata_settings table.
Set authenticationConfiguration.provider to basic in your server configuration. If the configuration uses environment variables, set AUTHENTICATION_PROVIDER=basic.
From a deployment that can reach the OpenMetadata database, remove the stored security configuration:
./bootstrap/openmetadata-ops.sh remove-security-config --force
OpenMetadata keeps the SSO configuration in its database and uses it over your server configuration at startup. Without this step, the server keeps using the unavailable SSO provider. This command removes both the authentication and the authorizer configuration.
Restart the OpenMetadata server or roll out all OpenMetadata server pods so every instance uses the same provider and reads the configuration from your server settings.
Open a private browser session and sign in with the Basic Auth administrator account.
Restore service or correct the SSO configuration.
Set authenticationConfiguration.provider back to the original SSO provider. Update any related environment variables in your server configuration as well.
Run ./bootstrap/openmetadata-ops.sh remove-security-config --force again so the server reads the restored SSO values on the next start. Alternatively, re-enter the values you recorded in step 2 under Settings > SSO.
Restart or roll out every OpenMetadata server instance.
Verify SSO sign-in.

After you restore SSO, users must sign in again because sessions issued by Basic Auth are no longer valid.

​UserName/Password Login

​Setting up Basic Auth Manually

​Set up Configurations in openmetadata.yaml

​Authentication Configuration

​Authorizer Configuration

​Metadata Ingestion

​Setting up SMTP Server

​Configure Ingestion

​Recover Access During an SSO Outage

UserName/Password Login

Setting up Basic Auth Manually

Set up Configurations in openmetadata.yaml

Authentication Configuration

Authorizer Configuration

Metadata Ingestion

Setting up SMTP Server

Configure Ingestion

Recover Access During an SSO Outage