# Authentication

```json metadata
{
  "title": "Authentication",
  "description": "Manage Redis Software cluster credentials, LDAP, SSO, and configuration secrets on Kubernetes.",
  "categories": ["docs","operate","kubernetes"],
  "tableOfContents": {"sections":[{"id":"how-authentication-works-on-redis-for-kubernetes","title":"How authentication works on Redis for Kubernetes"},{"id":"whats-the-same-as-redis-software","title":"What's the same as Redis Software"},{"id":"whats-different-on-kubernetes","title":"What's different on Kubernetes"},{"id":"in-this-section","title":"In this section"}]}

,
  "codeExamples": []
}
```
Authentication covers cluster credentials, external identity providers (LDAP and SAML SSO), and configuration secrets. The operator generates the initial cluster admin credentials, applies LDAP and SSO settings from the `RedisEnterpriseCluster` spec, and reads configuration values from Kubernetes Secrets you can update without a cluster restart.

## How authentication works on Redis for Kubernetes

- **Cluster credentials** are auto-generated at install and stored in a Kubernetes Secret named after the REC resource. Retrieve and update them with `kubectl`.
- **LDAP** is configured on the `RedisEnterpriseCluster` spec. The operator applies the configuration through the Redis Software REST API.
- **SAML SSO** is enabled on the REC spec. The operator configures the identity provider connection in Redis Software.
- **Configuration secrets** let you store sensitive configuration items in Kubernetes Secrets that the operator references. Updates to the Secret reconcile automatically.

## What's the same as Redis Software

The underlying Redis Software behavior is unchanged. For concepts and reference details, see the existing Redis Software docs:

- [LDAP authentication overview](https://redis.io/docs/latest/operate/rs/security/access-control/ldap) — server requirements, supported attributes, and the LDAP model.
- [Enable role-based LDAP](https://redis.io/docs/latest/operate/rs/security/access-control/ldap/enable-role-based-ldap) — concepts behind role-based LDAP.
- [Map LDAP groups to roles](https://redis.io/docs/latest/operate/rs/security/access-control/ldap/map-ldap-groups-to-roles) — group-to-role mapping rules.
- [SAML single sign-on](https://redis.io/docs/latest/operate/rs/security/access-control/saml-sso) — identity provider requirements and SAML attribute mappings.
- [Default user](https://redis.io/docs/latest/operate/rs/security/access-control/manage-users/default-user) — what the bootstrap admin account is for.

## What's different on Kubernetes

- **Initial credentials are auto-generated by default.** If you don't provide them, the operator generates them and stores them in the credentials Secret, which you retrieve after the REC is up. You can instead supply your own Secret name and credentials at cluster creation time.
- **Change the cluster admin credentials in Redis Software, then mirror them to the Secret.** Update the credentials directly in Redis Software and reflect the new values in the credentials Secret — see [Manage REC credentials](https://redis.io/docs/latest/operate/kubernetes/security/authentication/manage-rec-credentials). Credentials for other users are managed through their `RedisEnterpriseUser` resources and Secrets.
- **LDAP and SSO configuration is part of the REC spec.** The operator applies it through the Redis Software REST API, so the configuration is source-controlled.
- **Sensitive values live in Kubernetes Secrets** (or HashiCorp Vault) instead of in Redis Software configuration files.

## In this section

- [Manage REC credentials](https://redis.io/docs/latest/operate/kubernetes/security/authentication/manage-rec-credentials) — retrieve and update the cluster admin credentials Secret.
- [Manage REDB passwords](https://redis.io/docs/latest/operate/kubernetes/security/authentication/manage-redb-credentials) — retrieve and rotate database passwords through the database Secret.
- [Configuration secrets](https://redis.io/docs/latest/operate/kubernetes/security/authentication/configuration-secrets) — store config items in Kubernetes Secrets and reconcile updates automatically.
- [LDAP authentication](https://redis.io/docs/latest/operate/kubernetes/security/authentication/ldap) — configure LDAP for Cluster Manager and database access.
- [SSO authentication](https://redis.io/docs/latest/operate/kubernetes/security/authentication/sso) — configure SAML single sign-on for the Cluster Manager UI.