Authentication configuration settings

Available on Entry, Professional, Enterprise, and Enterprise Advanced plans

Mattermost supports up to 4 distinct, concurrent methods of user authentication:

• An OpenID provider
• A SAML provider
• An LDAP instance (e.g., Active Directory, OpenLDAP)
• Email and Password

Review and manage the following authentication configuration options in the System Console by selecting the Product menu, selecting System Console, and then selecting Authentication:

• Signup
• Email
• Password
• MFA
• AD/LDAP
• SAML 2.0
• OAuth 2.0
• OpenID Connect
• Guest Access

+Tip

System admins managing a self-hosted Mattermost deployment can edit the config.json file as described in the following tables. Each configuration value below includes a JSON path to access the value programmatically in the config.json file using a JSON-aware tool. For example, the EnableUserCreation value is under TeamSettings.

• If using a tool such as jq, you'd enter: cat config/config.json | jq '.TeamSettings.EnableUserCreation'
• When working with the config.json file manually, look for an object such as TeamSettings, then within that object, find the key EnableUserCreation.

---

Signup

Access the following configuration settings in the System Console by going to Authentication > Signup.

Enable account creation

true: (Default) Anyone can sign up for a user account on this server without needing to be invited. Applies to email-based signups only. false: The ability to create accounts is disabled. Selecting Create Account displays an error. Applies to email, OpenID Connect, and OAuth 2.0 user account authentication.

System Config path: Authentication > Signup config.json setting: TeamSettings > EnableUserCreation > true Environment variable: MM_TEAMSETTINGS_ENABLEUSERCREATION

iNote

• LDAP and SAML users can always create a Mattermost account by logging in using LDAP or SAML user credentials, regardless of whether this configuration setting is enabled.
• From Mattermost v10.9, email addresses enclosed in angle brackets (e.g., [billy@example.com](mailto:billy@example.com)) will be rejected. To avoid issues, ensure all user emails comply with the plain address format (e.g., billy@example.com). In addition, we strongly recommend taking proactive steps to audit and update Mattermost user data to align with this product change, as impacted users may face issues accessing Mattermost or managing their user profile. You can update these user emails manually using mmctl user email.
• See the supported SAML encryption methods.

Restrict account creation to specified email domains

This setting limits the email address domains that can be used to create a new account or team. | - System Config path: Authentication > Signup | You must set Require Email Verification | - config.json setting: TeamSettings > RestrictCreationToDomains to true for the restriction to function. This setting only affects email login. | - Environment variable: MM_TEAMSETTINGS_RESTRICTCREATIONTODOMAINS |

Enable open server

true: Users can create accounts on the server without an invitation. false: (Default) Users must have an invitation to create an account on the server.

System Config path: Authentication > Signup config.json setting: TeamSettings > EnableOpenServer Environment variable: MM_TEAMSETTINGS_ENABLEOPENSERVER

Enable email invitations

true: (Default for Cloud deployments) Allows users to send email invitations. false: (Default for self-hosted deployments) Disables email invitations.

System Config path: Authentication > Signup config.json setting: ServiceSettings > EnableEmailInvitations > false Environment variable: MM_SERVICESETTINGS_ENABLEEMAILINVITATIONS

iNote

Cloud admins can't modify this configuration setting.

Invalidate pending email invites

This button invalidates email invitations that have not been accepted (by default, invitations expire after 48 hours). This option has no config.json setting or environment variable.

System Config path: Authentication > Signup config.json setting: N/A Environment variable: N/A

---

Email

Access the following configuration settings in the System Console by going to Authentication > Email.

Enable account creation with email

true: (Default) Allows creation of team and user accounts with email and password. false: Disables creation of team and user accounts with email and password. Requires a single sign-on (SSO) service to create accounts.

System Config path: Authentication > Email config.json setting: EmailSettings > EnableSignUpWithEmail Environment variable: MM_EMAILSETTINGS_ENABLESIGNUPWITHEMAIL

iNote

Cloud admins can't modify this configuration setting.

Require email verification

true: (Default for Cloud deployments) Requires email verification for new accounts before allowing the user to sign-in. false: (Default for self-hosted deployments) Disables email verification. can be used to speed development by skipping the verification process.

System Config path: Authentication > Email config.json setting: EmailSettings > RequireEmailVerification > false Environment variable: MM_EMAILSETTINGS_REQUIREEMAILVERIFICATION

Enable sign-in with email

true: (Default) Allows users to sign-in with email and password. false: Disables authentication with email and password, and removes the option from the login screen. Use this option to limit authentication to single sign-on services.

System Config path: Authentication > Email config.json setting: EmailSettings > EnableSignInWithEmail Environment variable: MM_EMAILSETTINGS_ENABLESIGNINWITHEMAIL

iNote

- To provide users with only a single email sign in option on the login page, ensure that the enable sign-in with username configuration setting is set to false. - From Mattermost v10.9, email addresses enclosed in angle brackets (e.g., [billy@example.com](mailto:billy@example.com)) will be rejected. To avoid issues, ensure all user emails comply with the plain address format (e.g., billy@example.com). In addition, we strongly recommend taking proactive steps to audit and update Mattermost user data to align with this product change, as impacted users may face issues accessing Mattermost or managing their user profile. You can update these user emails manually using mmctl user email.

Enable sign-in with username

true: (Default) Allows authentication with a username and password for accounts created with an email address. This setting does not affect AD/LDAP sign-in. false: Disables authenticaton with a username and removes the sign in option from. from the login screen.

System Config path: Authentication > Email config.json setting: EmailSettings > EnableSignInWithUsername Environment variable: MM_EMAILSETTINGS_ENABLESIGNINWITHUSERNAME

iNote

We highly recommended that email-based authentication is only used in small teams on private networks.

---

Password

Access the following configuration settings in the System Console by going to Authentication > Password.

iNote

From Mattermost v11.0, password hashing uses PBKDF2 for enhanced security. User passwords are automatically migrated when they log in after upgrading to v11.0 or later. This migration is progressive and happens transparently when users authenticate.

Minimum password length

This setting determines the minimum number of characters in passwords. It must be a whole number greater than or equal to 5 and less than or equal to 72. Numerical input. Default is 5.

System Config path: Authentication > Password config.json setting: PasswordSettings > MinimumLength Environment variable: MM_PASSWORDSETTINGS_MINIMUMLENGTH

Password requirements

This setting controls password character requirements. By checking the corresponding box, passwords must contain: At least one lowercase letter At least one uppercase letter At least one number At least one symbol out of these: !"#$%&'()*+,-./:;<=>?@[]^_`|~. The error message previewed in the System Console will appear if the user attempts to set an invalid password. The default for all boxes is unchecked. The default for all settings in config.json is false.

System Config path: Authentication > Password config.json settings: PasswordSettings > Lowercase > false, PasswordSettings > Uppercase > false, PasswordSettings > Number > false, PasswordSettings > Symbol > false Environment variables: MM_PASSWORDSETTINGS_LOWERCASE, MM_PASSWORDSETTINGS_UPPERCASE, MM_PASSWORDSETTINGS_NUMBER, MM_PASSWORDSETTINGS_SYMBOL

Maximum login attempts

This setting determines the number of failed sign-in attempts a user can make before being locked out and required to go through a password reset by email. Numerical input. Default is 10.

System Config path: Authentication > Password config.json setting: ServiceSettings > MaximumLoginAttempts > 10 Environment variable: MM_SERVICESETTINGS_MAXIMUMLOGINATTEMPTS

Enable forgot password link

true: (Default) Displays the Forget Password link on the Mattermost login page. false: Hides the Forgot Password link from the Mattermost login page.

System Config path: Authentication > Enable forgot password link config.json setting: LdapSettings > ForgotPasswordLink > true Environment variable: MM_LDAPSETTINGS_FORGOTPASSWORDLINK

iNote

You can customize the Forgot Password link URL by going to Site Configuration > Customization > Forgot Password Custom Link. See the configuration documentation for details.

---

MFA

Available on Entry, Professional, Enterprise, and Enterprise Advanced plans

Access the following configuration settings in the System Console by going to Authentication > MFA.

We recommend deploying Mattermost within your own private network, and using VPN clients for mobile access, so that Mattermost is secured with your existing protocols. If you choose to run Mattermost outside your private network, bypassing your existing security protocols, we recommend adding a multi-factor authentication service specifically for accessing Mattermost.

Enable multi-factor authentication

true: Users who sign-in with AD/LDAP or an email address have the option to add | - System Config path: Authentication > MFA | multi-factor authentication to their accounts. | - config.json setting: ServiceSettings > EnableMultifactorAuthentication > false false: (Default) Disables multi-factor authentication. | - Environment variable: MM_SERVICESETTINGS_ENABLEMULTIFACTORAUTHENTICATION |

Enforce multi-factor authentication

- true: Requires multi-factor authentication (MFA) | - System Config path: Authentication > MFA | | - config.json setting: ServiceSettings > EnforceMultifactorAuthentication > false for users who sign-in with AD/LDAP or an email address. | - Environment variable: MM_SERVICESETTINGS_ENFORCEMULTIFACTORAUTHENTICATION | New users must set up MFA. Logged in users are redirected to the MFA | | setup page until configuration is complete. | | false: (Default) MFA is optional. | |

iNote

If your system has users who authenticate with methods other than AD/LDAP and email, MFA must be enforced with the authentication provider outside of Mattermost.

---

AD/LDAP

Access the following configuration settings in the System Console by going to Authentication > AD/LDAP. This opens the AD/LDAP setup wizard with step-by-step sections and testing to help configure each setting.

The wizard is organized into the following sections:

• Connection settings: Configure server connection details
• User filters: Set up user identification and filtering
• Account synchronization: Map AD/LDAP attributes to Mattermost user fields
• Group synchronization: Configure group settings and group attributes (if using LDAP groups)
• Synchronization performance: Adjust synchronization timing and performance settings
• Synchronization history: View synchronization status and manually trigger syncs

iNote

Each section includes a Test option you can use to verify your configuration incrementally, helping identify and resolve issues early in the setup process.

Connection settings

Configure your AD/LDAP server connection and basic authentication settings. Use the Test Connection button in this section to verify your server connection before proceeding to other configuration steps.

Enable sign-in with AD/LDAP

true: Allows sign-in with AD/LDAP. false: (Default) Disables sign-in with AD/LDAP.

System Config path: Authentication > AD/LDAP config.json setting: LdapSettings > Enable > false Environment variable: MM_LDAPSETTINGS_ENABLE

Enable synchronization with AD/LDAP

Available on Entry, Enterprise, and Enterprise Advanced plans (not available on Professional) plans

true: Mattermost periodically syncs users from AD/LDAP. false: (Default) Disables AD/LDAP synchronization.

System Config path: Authentication > AD/LDAP config.json setting: LdapSettings > EnableSync > false Environment variable: MM_LDAPSETTINGS_ENABLESYNC

iNote

Synchronization with AD/LDAP settings in the System Console can be used to determine the connectivity and availability of arbitrary hosts. System admins concerned about this can use custom admin roles to limit access to modifying these settings. See the delegated granular administration) documentation for details.

Login field name

This setting will display placeholder text in the login field of the sign-in page. This text can remind users to sign-in with their AD/LDAP credentials. String input. Default is AD/LDAP Username.

System Config path: Authentication > AD/LDAP config.json setting: LdapSettings > LoginFieldName Environment variable: MM_LDAPSETTINGS_LOGINFIELDNAME

AD/LDAP server

This is the domain name or IP address of the AD/LDAP server. String input.

System Config path: Authentication > AD/LDAP config.json setting: LdapSettings > LdapServer Environment variable: MM_LDAPSETTINGS_LDAPSERVER

iNote

Synchronization with AD/LDAP settings in the System Console can be used to determine the connectivity and availability of arbitrary hosts. System admins concerned about this can use custom admin roles to limit access to modifying these settings. See the delegated granular administration) documentation for details.

AD/LDAP port

This is the port Mattermost uses to connect to the AD/LDAP server. Numerical input. Default is 389.

System Config path: Authentication > AD/LDAP config.json setting: LdapSettings > LdapPort > 389 Environment variable: MM_LDAPSETTINGS_LDAPPORT

Bind username

This is the username for the account Mattermost utilizes to perform an AD/LDAP search. This should be an account specific to Mattermost. Limit the permissions of the account to read-only access to the portion of the AD/LDAP tree specified in the Base DN setting. When using Active Directory, Bind Username should specify domain in "DOMAIN/username" format. String input.

System Config path: Authentication > AD/LDAP config.json setting: LdapSettings > BindUsername Environment variable: MM_LDAPSETTINGS_BINDUSERNAME

iNote

This field is required. Anonymous bind is not currently supported.

Bind password

This is the password for the username given in the Bind Username setting. String input.

System Config path: Authentication > AD/LDAP config.json setting: LdapSettings > BindPassword Environment variable: MM_LDAPSETTINGS_BINDPASSWORD

Connection security

This setting controls the type of security Mattermost uses to connect to the AD/LDAP server, with these options: None: (Default for self-hosted deployments) No encryption. With this option, it is highly recommended that the connection be secured outside of Mattermost, such as by a stunnel proxy. config.json option: "" TLS: (Default for Cloud deployments) Encrypts communication with TLS. config.json option: "TLS" STARTTLS: Attempts to upgrade an existing insecure connection to a secure connection with TLS. config.json option: "STARTTLS"

System Config path: Authentication > AD/LDAP config.json setting: LdapSettings > ConnectionSecurity > "" Environment variable: MM_LDAPSETTINGS_CONNECTIONSECURITY

Skip certificate verification

true: Disables the certificate verification step for TLS and STARTTLS connections. Use this option for testing. Do not use this option when TLS is required in production. false: (Default) Enables certification verification.

System Config path: Authentication > AD/LDAP config.json setting: LdapSettings > SkipCertificateVerification > false Environment variable: MM_LDAPSETTINGS_SKIPCERTIFICATEVERIFICATION

Private key

Use this setting to upload the private key file from your LDAP authentication provider, if TLS client certificates are the primary authentication mechanism. String input.

System Config path: Authentication > AD/LDAP config.json setting: LdapSettings > PrivateKeyFile Environment variable: MM_LDAPSETTINGS_PRIVATEKEYFILE

Public certificate

Use this setting to upload the public TLS certificate from your LDAP authentication provider, if TLS client certificates are the primary authentication mechanism. String input.

System Config path: Authentication > AD/LDAP config.json setting: LdapSettings > PublicCertificateFile Environment variable: MM_LDAPSETTINGS_PUBLICCERTIFICATEFILE

Maximum login attempts

This setting determines the number of failed sign-in attempts a user can make before being locked out and required to go through a password reset by email. You can unlock the account in System Console on the users page. Setting this value lower than your LDAP maximum login attempts ensures that the users won't be locked out of your LDAP server because of failed login attempts in Mattermost. Numerical input. Default is 10.

System Config path: Authentication > AD/LDAP config.json setting: LdapSettings > MaximumLoginAttempts > 10 Environment variable: MM_LDAPSETTINGS_MAXIMUMLOGINATTEMPTS

iNote

• Adjust this value to align with your organization’s authentication policies.
• If a user's account is locked, you can unlock it manually by going to System console > User Management > Users.

User filters

Define how Mattermost identifies and filters users and groups from your AD/LDAP directory. Use the Test Filters button in this section to verify your filters work correctly before proceeding to other configuration steps.

Base DN

This is the Base Distinguished Name of the location in the AD/LDAP tree where Mattermost will start searching for users. String input.

System Config path: Authentication > AD/LDAP config.json setting: LdapSettings > BaseDN Environment variable: MM_LDAPSETTINGS_BASEDN

User filter

This setting accepts a general syntax AD/LDAP filter that is applied when searching for user objects. Only the users selected by the query can access Mattermost. For example, to filter out disabled users, the filter is: (&(objectCategory=Person)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))). To filter by group membership, determine the distinguishedName of the group, then use group membership general syntax to format the filter. For example, if the security group distinguishedName is CN=group1,OU=groups,DC=example,DC=com, then the filter is: (memberOf=CN=group1,OU=groups,DC=example,DC=com). The user must explicitly belong to this group for the filter to apply. String input.

System Config path: Authentication > AD/LDAP config.json setting: LdapSettings > UserFilter Environment variable: MM_LDAPSETTINGS_USERFILTER

iNote

This filter uses the permissions of the Bind Username account to execute the search. This account should be specific to Mattermost and have read-only access to the portion of the AD/LDAP tree specified in the Base DN field.

Group filter

Available on Entry, Enterprise, and Enterprise Advanced plans (not available on Professional) plans

This setting accepts a general syntax AD/LDAP filter that is applied when searching for group objects. Only the groups selected by the query can access Mattermost. String input. Default is (|(objectClass=group)(objectClass=groupOfNames)(objectClass=groupOfUniqueNames)).

System Config path: Authentication > AD/LDAP config.json setting: LdapSettings > GroupFilter Environment variable: MM_LDAPSETTINGS_GROUPFILTER

iNote

This filter is only used when AD/LDAP Group Sync is enabled. See AD/LDAP Group Sync for more information.

Enable admin filter

true: Enables the Admin Filter setting that designates system admins using an AD/LDAP filter. false: (Default) Disables the Admin Filter setting.

System Config path: Authentication > AD/LDAP config.json setting: LdapSettings > EnableAdminFilter > false Environment variable: MM_LDAPSETTINGS_ENABLEADMINFILTER

iNote

If this setting is false, no additional users are designated as system admins by the filter. Users that were previously designated as system admins retain this role unless the filter is changed or removed.

Admin filter

This setting accepts an AD/LDAP filter that designates the selected users as system admins. Users are promoted to this role on their next sign-in or on the next scheduled AD/LDAP sync. If the Admin Filter is removed, users who are currently logged in retain their Admin role until their next sign-in. String input.

System Config path: Authentication > AD/LDAP config.json setting: LdapSettings > AdminFilter Environment variable: MM_LDAPSETTINGS_ADMINFILTER

Guest filter

This setting accepts an AD/LDAP filter to apply when searching for external users with Guest Access to Mattermost. Only users selected by the query can access Mattermost as Guests. | - System Config path: Authentication > AD/LDAP | - config.json setting: LdapSettings > GuestFilter | See Guest Accounts for more information. | - Environment variable: MM_LDAPSETTINGS_GUESTFILTER                                                               | String input. | |

Account synchronization

Available on Entry, Enterprise, and Enterprise Advanced plans (not available on Professional) plans

Map AD/LDAP user attributes to Mattermost user profile fields. Use the Test Attributes button in this section to verify correct attribute mapping and data synchronization before proceeding to other configuration steps.

ID attribute

This is the attribute in the AD/LDAP server that is serves as a unique user identifier in Mattermost. The attribute should have a unique value that does not change, such as objectGUID or entryUUID. Confirm that these attributes are available in your environment before making any changes. String input.

System Config path: Authentication > AD/LDAP config.json setting: LdapSettings > IdAttribute Environment variable: MM_LDAPSETTINGS_IDATTRIBUTE

iNote

If a user's ID Attribute changes, a new Mattermost account is created that is not associated with the previous account. If you need to change this field after users have signed-in, use the mmctl ldap idmigrate command.

iNote

The ID attribute value is matched verbatim - Mattermost applies no case normalization. With PostgreSQL's default case-sensitive collation, a change in casing is treated as a new user and a separate account is created. Ensure your AD/LDAP server returns this attribute with consistent casing.

Login ID attribute

This is the attribute in the AD/LDAP server that is used for signing-in to Mattermost. This is normally the same as the Username Attribute. If your team uses domain\username to sign-in to other services with AD/LDAP, you may enter domain\username in this field to maintain consistency between sites. String input.

System Config path: Authentication > AD/LDAP config.json setting: LdapSettings > LoginIdAttribute Environment variable: MM_LDAPSETTINGS_LOGINIDATTRIBUTE

Username attribute

This is the attribute in the AD/LDAP server that populates the username field in Mattermost. This attribute identifies users in the UI. For example, if a Username Attribute is set to john.smith, typing @john will show @john.smith as an auto-complete option, and posting a message with @john.smith will send a notification to that user. This is normally the same as the Login ID Attribute, but it can be mapped to a different attribute. String input.

System Config path: Authentication > AD/LDAP config.json setting: LdapSettings > UsernameAttribute Environment variable: MM_LDAPSETTINGS_USERNAMEATTRIBUTE

Email attribute

This is the attribute in AD/LDAP server that populates the email address field in Mattermost. Email notifications are sent to this address. The address may be seen by other Mattermost users depending on privacy settings. String input.

System Config path: Authentication > AD/LDAP config.json setting LdapSettings > EmailAttribute Environment variable: MM_LDAPSETTINGS_EMAILATTRIBUTE

First name attribute

This is the attribute in the AD/LDAP server that populates the first name field in Mattermost. | - System Config path: Authentication > AD/LDAP | - config.json setting: LdapSettings > FirstNameAttribute | When set, users cannot edit their first name. | - Environment variable: MM_LDAPSETTINGS_FIRSTNAMEATTRIBUTE |                                                                      | When not set, users can edit their first name in their | | profile settings. | | | String input. | |

Last name attribute

This is the attribute in the AD/LDAP server that populates the last name field in Mattermost. | - System Config path: Authentication > AD/LDAP | - config.json setting: LdapSettings > LastNameAttribute | When set, users cannot edit their last name. | - Environment variable: MM_LDAPSETTINGS_LASTNAMEATTRIBUTE |                                                                     | When not set, users can edit their last name as part of their | | profile settings. | | | | String input. | |

Nickname attribute

This is the attribute in the AD/LDAP server that populates the nickname field in Mattermost. | - System Config path: Authentication > AD/LDAP | - config.json setting: LdapSettings > NicknameAttribute | When set, users cannot edit their nickname. | - Environment variable: MM_LDAPSETTINGS_NICKNAMEATTRIBUTE |                                                                     | When not set, users can edit their nickname as part of their | | profile settings. | | | String input. | |

Position attribute

This is the attribute in the AD/LDAP server that populates the position field in Mattermost. | - System Config path: Authentication > AD/LDAP | - config.json setting: LdapSettings > PositionAttribute | When set, users cannot edit their position. | - Environment variable: MM_LDAPSETTINGS_POSITIONATTRIBUTE |                                                                     | When not set, users can edit their position as part of their | | profile settings. | | | String input. | |

Profile picture attribute

This is the attribute in the AD/LDAP server that syncs and locks the profile picture in Mattermost. The image is updated when users sign-in, not when Mattermost syncs with the AD/LDAP server. The image is not updated if the Mattermost image already matches the AD/LDAP image. String input.

System Config path: Authentication > AD/LDAP config.json setting: LdapSettings > PictureAttribute Environment variable: MM_LDAPSETTINGS_PICTUREATTRIBUTE

Group synchronization

Available on Entry, Enterprise, and Enterprise Advanced plans (not available on Professional) plans

Configure group mapping for AD/LDAP group synchronization. Use the Test Group Attributes button in this section to verify proper group attribute mapping before proceeding to other configuration steps.

Group display name attribute

This is the AD/LDAP Group Display name attribute that populates the Mattermost group name field. String input.

System Config path: Authentication > AD/LDAP config.json setting: LdapSettings > GroupDisplayNameAttribute Environment variable: MM_LDAPSETTINGS_GROUPDISPLAYNAMEATTRIBUTE

iNote

This attribute is only used when AD/LDAP Group Sync is enabled and it is required. See the AD/LDAP Group Sync documentation for more information.

Group ID attribute

This is an AD/LDAP Group ID attribute that sets a unique identifier for groups. This should be a value that does not change, such as entryUUID or objectGUID. String input.

System Config path: Authentication > AD/LDAP config.json setting: LdapSettings > GroupIdAttribute Environment variable: MM_LDAPSETTINGS_GROUPIDATTRIBUTE

iNote

This attribute is only used when AD/LDAP Group Sync is enabled and it is required. See the AD/LDAP Group Sync documentation for more information.

iNote

The Group ID attribute value is matched verbatim - Mattermost applies no case normalization. With PostgreSQL's default case-sensitive collation, a change in casing means Mattermost no longer recognizes the previously synced group and treats it as a new, unlinked group. Ensure your AD/LDAP server returns this attribute with consistent casing.

Synchronization performance

Available on Entry, Enterprise, and Enterprise Advanced plans (not available on Professional) plans

Configure timing and performance settings for AD/LDAP synchronization. These settings control how often Mattermost syncs with your AD/LDAP server.

Synchronization interval (minutes)

This value determines how often Mattermost syncs with the AD/LDAP server by setting the number of minutes between each sync. Syncing with the AD/LDAP server will update Mattermost accounts to match any changes made to AD/LDAP attributes. Disabled AD/LDAP accounts become deactivated users in Mattermost, and any active sessions are revoked. Use the AD/LDAP Synchronize Now button to immediately revoke a session after disabling an AD/LDAP account. Numerical input. Default is 60.

System Config path: Authentication > AD/LDAP config.json setting: LdapSettings > SyncIntervalMinutes > 60 Environment variable: MM_LDAPSETTINGS_SYNCINTERVALMINUTES

iNote

LDAP syncs require a large number of database read queries. Monitor database load and adjust the sync interval to minimize performance degradation.

Maximum page size

This setting paginates the results of AD/LDAP server queries. Use this setting if your AD/LDAP server has a page size limit. The recommended setting is 1500. This is the default AD/LDAP MaxPageSize. A page size of 0 disables pagination of results. Numerical input. Default is 0.

System Config path: Authentication > AD/LDAP config.json setting: LdapSettings > MaxPageSize > 0 Environment variable: MM_LDAPSETTINGS_MAXPAGESIZE

Query timeout (seconds)

This setting determines the timeout period, in seconds, for AD/LDAP queries. Increase this value to avoid timeout errors when querying a slow server. Numerical input. Default is 60.

System Config path: Authentication > AD/LDAP config.json setting: LdapSettings > QueryTimeout > 60 Environment variable: MM_LDAPSETTINGS_QUERYTIMEOUT

Synchronization history

Available on Entry, Enterprise, and Enterprise Advanced plans (not available on Professional) plans

View synchronization status and manually trigger AD/LDAP synchronization. This section includes the AD/LDAP Synchronize Now button for immediate synchronization.

AD/LDAP synchronize now

Use this button to immediately sync with the AD/LDAP server. The status of the sync is displayed in the table underneath the button (see the figure below). Following a manual sync, the next sync will occur after the time set in the Synchronization Interval.

System Config path: Authentication > AD/LDAP config.json setting: N/A Environment variable: N/A

iNote

If a sync is Pending and does not complete, check that Enable Synchronization with AD/LDAP is set to true.

Config settings not available in the AD/LDAP Wizard

Available on Entry, Enterprise, and Enterprise Advanced plans (not available on Professional) plans

The following AD/LDAP configuration settings are available in the config.json file only and aren't available via the AD/LDAP wizard interface in the System Console.

Re-add removed members on sync

Enable this setting to re-add members of the LDAP group that were previously removed from group-synchronized teams or channels during LDAP synchronization. true: Members of the LDAP group who were previously removed are re-added to group-synchronized teams or channels during LDAP synchronization. false: (Default) Members of the LDAP group who were previously removed are not re-added to group-synchronized teams or channels during LDAP synchronization.

System Config path: Authentication > AD/LDAP config.json setting: LdapSettings > ReAddRemovedMembers Environment variable: MM_LDAPSETTINGS_READDREMOVEDMEMBERS

iNote

The mmctl ldap sync command takes precedence over this server configuration setting. If you have this setting disabled, and run the mmctl command with the --include-removed-members flag, removed members will be re-added during LDAP synchronization.

---

SAML 2.0

Access the following configuration settings in the System Console by going to Authentication > SAML 2.0.

See the supported SAML encryption methods.

!Important

In line with Microsoft ADFS guidance, we recommend configuring intranet forms-based authentication for devices that do not support WIA.

Enable login with SAML

true: Enables sign-in with SAML. See SAML Single Sign-On to learn more. | - System Config path: Authentication > SAML 2.0 false: (Default) Disables sign-in with SAML. | - config.json setting: SamlSettings > Enable > false | - Environment variable: MM_SAMLSETTINGS_ENABLE |

Enable synchronizing SAML accounts with AD/LDAP

Available on Enterprise and Enterprise Advanced plans

true: Mattermost updates configured Mattermost user attributes (ex. FirstName, Position, Email) with their values from AD/LDAP. From v10.9, Mattermost checks whether a user exists on the connected LDAP server during login. If the user doesn't exist on the LDAP server, login fails. false: (Default) Disables syncing of SAML-authenticated Mattermost users with AD/LDAP. From Mattermost v10.9, Mattermost doesn't check whether a user exists on the connected LDAP server during login.

System Config path: Authentication > SAML 2.0 config.json setting: SamlSettings > EnableSyncWithLdap > false Environment variable: MM_SAMLSETTINGS_ENABLESYNCWITHLDAP

iNote

• AD/LDAP synchronization must be enabled and configured through the settings under Authentication > AD/LDAP.
• Prior to Mattermost v10.9, users not present on the LDAP server could log in, but would be deactivated on the next LDAP sync.
• See AD/LDAP Setup to learn more about configuring AD/LDAP.

Ignore guest users when synchronizing with AD/LDAP

Available on Entry, Enterprise, and Enterprise Advanced plans (not available on Professional) plans

true: When syncing with the AD/LDAP server, Mattermost does not sync any information about SAML-authenticated Guest Users from the AD/LDAP server. Manage guest deactivation manually via System Console > Users. false: (Default) Syncing Mattermost with the AD/LDAP server updates Guest User attributes and deactivates and removes SAML-authenticated accounts for Guest Users that are no longer active on the AD/LDAP server.

System Config path: Authentication > SAML 2.0 config.json setting: SamlSettings > IgnoreGuestsLdapSync > false Environment variable: MM_SAMLSETTINGS_IGNOREGUESTSLDAPSYNC

For more information, see AD/LDAP Setup for details.

Override SAML bind data with AD/LDAP information

true: If the SAML ID attribute is configured, Mattermost overrides the SAML ID attribute with the AD/LDAP ID attribute. If the SAML ID attribute is not present, Mattermost overrides the SAML Email attribute with the AD/LDAP Email attribute. false: (Default) Mattermost uses the email attribute to bind users to SAML. This setting is only available when SAML authentication is enabled and AD/LDAP synchronization is enabled.

System Config path: Authentication > SAML 2.0 config.json setting: SamlSettings > EnableSyncWithLdapIncludeAuth > false Environment variable: MM_SAMLSETTINGS_ENABLESYNCWITHLDAPINCLUDEAUTH

iNote

- This setting should be false unless LDAP sync is enabled. Changing this setting from true to false will disable the override. - SAML IDs must match LDAP IDs when the override is enabled. - For more information, see AD/LDAP Setup for details.

Identity provider metadata URL

This setting is the URL from which Mattermost requests setup metadata from the provider. String input.

System Config path: Authentication > SAML 2.0 config.json setting: SamlSettings > IdpMetadataURL Environment variable: MM_SAMLSETTINGS_IDPMETADATAURL

SAML SSO URL

This setting is the URL where Mattermost sends a SAML request to start the login sequence. String input.

System Config path: Authentication > SAML 2.0 config.json setting: SamlSettings > IdpURL Environment variable: MM_SAMLSETTINGS_IDPURL

Identity provider issuer URL

This setting is the issuer URL for the Identity Provider for SAML requests. String input.

System Config path: Authentication > SAML 2.0 config.json setting: SamlSettings > IdpDescriptorURL Environment variable: MM_SAMLSETTINGS_IDPDESCRIPTORURL

Identity provider public certificate

The public authentication certificate issued by your Identity Provider. String input.

System Config path: Authentication > SAML 2.0 config.json setting: SamlSettings > IdpCertificateFile Environment variable: MM_SAMLSETTINGS_IDPCERTIFICATEFILE

Verify signature

true: (Default) Mattermost checks that the SAML Response signature matches the Service Provider Login URL. false: The signature is not verified. This is not recommended for production. Use this option for testing only.

System Config path: Authentication > SAML 2.0 config.json setting: SamlSettings > Verify > true Environment variable: MM_SAMLSETTINGS_VERIFY

Service provider login URL

Enter the URL of your Mattermost server, followed by /login/sso/saml, i.e. https://example.com/login/sso/saml. Use HTTP or HTTPS depending on the configuration of the server. This setting is also known as the Assertion Consumer Service URL.

System Config path: Authentication > SAML 2.0 config.json setting: SamlSettings > AssertionConsumerServiceURL Environment variable: MM_SAMLSETTINGS_ASSERTIONCONSUMERSERVICEURL

Service provider identifier

This setting is the unique identifier for the Service Provider, which in most cases is the same as the Service Provider Login URL. In ADFS, this must match the Relying Party Identifier. String input.

System Config path: Authentication > SAML 2.0 config.json setting: SamlSettings > ServiceProviderIdentifier Environment variable: MM_SAMLSETTINGS_SERVICEPROVIDERIDENTIFIER

Enable encryption

true: (Default) Mattermost will decrypt SAML Assertions that are encrypted with your Service Provider Public Certificate. false: Mattermost does not decrypt SAML Assertions. Use this option for testing only. It is not recommended for production.

System Config path: Authentication > SAML 2.0 config.json setting: SamlSettings > Encrypt > true Environment variable: MM_SAMLSETTINGS_ENCRYPT

Supported SAML encryption methods

Mattermost supports the following encryption methods for SAML:

• aes128-gcm
• aes192-gcm
• aes256-gcm
• aes128-cbc
• aes256-cbc

AES-192-GCM and AES-256-GCM support was introduced in Mattermost v10.9.

Service provider private key

This setting stores the private key used to decrypt SAML Assertions from the Identity Provider. String input.

System Config path: Authentication > SAML 2.0 config.json setting: SamlSettings > PrivateKeyFile Environment variable: MM_SAMLSETTINGS_PRIVATEKEYFILE

Service provider public certificate

This setting stores the certificate file used to sign a SAML request to the Identity Provider for a SAML login when Mattermost is initiating the login as the Service Provider. String input.

System Config path: Authentication > SAML 2.0 config.json setting: SamlSettings > PublicCertificateFile Environment variable: MM_SAMLSETTINGS_PUBLICCERTIFICATEFILE

Sign request

true: Mattermost signs the SAML request with the Service Provider Private Key. false: Mattermost does not sign the SAML request.

System Config path: Authentication > SAML 2.0 config.json setting: SamlSettings > SignRequest Environment variable: MM_SAMLSETTINGS_SIGNREQUEST

Signature algorithm

This setting determines the signature algorithm used to sign the SAML request. Options are: RSAwithSHA1, RSAwithSHA256, RSAwithSHA512. String input. iNote From Mattermost v11, the default signature algorithm has been updated from RSAwithSHA1 to RSAwithSHA256 for improved security. Existing configurations will continue to work, but new installations will default to RSAwithSHA256.

System Config path: Authentication > SAML 2.0 config.json setting: SamlSettings > SignatureAlgorithm Environment variable: MM_SAMLSETTINGS_SIGNATUREALGORITHM

Canonical algorithm

This setting determines the canonicalization algorithm. With these options: Canonical1.0: (Default) Exclusive XML Canonicalization 1.0 (omit comments) (http://www.w3.org/2001/10/xml-exc-c14n#). config.json setting: Canonical1.0. Canonical1.1: Canonical XML 1.1 (omit comments) (http://www.w3.org/2006/12/xml-c14n11). config.json setting: Canonical1.1. String input.

System Config path: Authentication > SAML 2.0 config.json setting: SamlSettings > CanonicalAlgorithm Environment variable: MM_SAMLSETTINGS_CANONICALALGORITHM

Email attribute

This setting determines the attribute from the SAML Assertion that populates the user email address field in Mattermost. Notifications are sent to this email address. This email address may be visible to other users, depending on how the system admin has set-up user privacy. String input.

System Config path: Authentication > SAML 2.0 config.json setting: SamlSettings > EmailAttribute Environment variable: MM_SAMLSETTINGS_EMAILATTRIBUTE

Username attribute

This setting determines the SAML Assertion attribute that populates the username field in the Mattermost UI. This attribute identifies users in the UI. For example, if a username is set to john.smith, typing @john will show @john.smith as an auto-complete option, and posting a message with @john.smith will send a notification to that user. String input.

System Config path: Authentication > SAML 2.0 config.json setting: SamlSettings > UsernameAttribute Environment variable: MM_SAMLSETTINGS_USERNAMEATTRIBUTE

Id attribute

(Optional) This setting determines the SAML Assertion attribute used to bind users from SAML to users in Mattermost. String input.

System Config path: Authentication > SAML 2.0 config.json setting: SamlSettings > IdAttribute Environment variable: MM_SAMLSETTINGS_IDATTRIBUTE

iNote

The ID attribute value is matched verbatim - Mattermost applies no case normalization. With PostgreSQL's default case-sensitive collation, a change in casing is treated as a new user and a separate account is created. Ensure your identity provider returns this attribute with consistent casing.

Guest attribute

(Optional) This setting determines the SAML Assertion attribute used to apply a Guest role to users in Mattermost. | - System Config path: Authentication > SAML 2.0 | - config.json setting: SamlSettings > GuestAttribute| See the Guest Accounts documentation for more information. | - Environment variable: MM_SAMLSETTINGS_GUESTATTRIBUTE                                                                 | String input. | |

Enable admin attribute

true: System admin status is determined by the SAML Assertion attribute set in Admin attribute. false: (Default) System admin status is not determined by the SAML Assertion attribute.

System Config path: Authentication > SAML 2.0 config.json setting: SamlSettings > EnableAdminAttribute > false Environment variable: MM_SAMLSETTINGS_ENABLEADMINATTRIBUTE

Admin attribute

(Optional) This setting determines the attribute in the SAML Assertion for designating system admins. Users are automatically promoted to this role when logging in to Mattermost. If the Admin attribute is removed, users that are logged in retain Admin status. The role is revoked only when users log out. String input.

System Config path: Authentication > SAML 2.0 config.json setting: SamlSettings > AdminAttribute Environment variable: MM_SAMLSETTINGS_ADMINATTRIBUTE

First name attribute

(Optional) This setting determines the SAML Assertion attribute that populates the first name of users in Mattermost. String input.

System Config path: Authentication > SAML 2.0 config.json setting: SamlSettings > FirstNameAttribute Environment variable: MM_SAMLSETTINGS_FIRSTNAMEATTRIBUTE

Last name attribute

(Optional) This setting determines the SAML Assertion attribute that populates the last name of users in Mattermost. String input.

System Config path: Authentication > SAML 2.0 config.json setting: SamlSettings > LastNameAttribute Environment variable: MM_SAMLSETTINGS_LASTNAMEATTRIBUTE

Nickname attribute

(Optional) This setting determines the SAML Assertion attribute that populates the nickname of users in Mattermost. String input.

System Config path: Authentication > SAML 2.0 config.json setting: SamlSettings > NicknameAttribute Environment variable: MM_SAMLSETTINGS_NICKNAMEATTRIBUTE

Position attribute

(Optional) This setting determines the SAML Assertion attribute that populates the position (job title or role at company) of users in Mattermost. String input.

System Config path: Authentication > SAML 2.0 config.json setting: SamlSettings > PositionAttribute Environment variable: MM_SAMLSETTINGS_POSITIONATTRIBUTE

Preferred language attribute

(Optional) This setting determines the SAML Assertion attribute that populates the language preference of users in Mattermost. String input.

System Config path: Authentication > SAML 2.0 config.json setting: SamlSettings > LocaleAttribute Environment variable: MM_SAMLSETTINGS_LOCALEATTRIBUTE

Login button text

(Optional) The text that appears in the login button on the sign-in page. String input. Default is SAML.

System Config path: Authentication > SAML 2.0 config.json setting: SamlSettings > LoginButtonText Environment variable: MM_SAMLSETTINGS_LOGINBUTTONTEXT

---

OAuth 2.0

Access the following configuration settings in the System Console by going to Authentication > OAuth 2.0. Settings for GitLab OAuth authentication can also be accessed under Authentication > GitLab in self-hosted deployments.

Use these settings to configure OAuth 2.0 for account creation and login.

Select OAuth 2.0 service provider

Use this setting to enable OAuth and specify the service provider, with these options: Do not allow login via an OAuth 2.0 provider GitLab (Available in all plans; see GitLab 2.0 OAuth settings) Google Apps (Available in Mattermost Enterprise and Professional; see Google OAuth 2.0 settings) Entra ID (Available in Mattermost Enterprise and Professional; see Entra ID OAuth 2.0 settings)

System Config path: Authentication > OAuth 2.0 config.json setting: N/A Environment variable: N/A

GitLab OAuth 2.0 settings

iNote

For Enterprise subscriptions, GitLab settings can be found under OAuth 2.0

Enable OAuth 2.0 authentication with GitLab

true: Allows team and account creation using GitLab OAuth authentication. Input the Secret and ID credentials to configure. false: (Default) Disables GitLab OAuth authentication.

System Config path: Authentication > OAuth 2.0 (or GitLab) config.json setting: GitLabSettings > Enable > false Environment variable: MM_GITLABSETTINGS_ENABLE

GitLab OAuth 2.0 Application ID

This setting holds the OAuth Application ID from GitLab. Generate the ID by these steps: Login to your GitLab account. Go to Profile Settings > Applications > New Application and enter a name. Enter the Redirect URLs: https://<your-mattermost-url>/login/gitlab/complete and https://<your-mattermost-url>/signup/gitlab/complete. Take the Application ID provided by GitLab and enter it in the Mattermost System Console field, config.json setting, or Environment variable. String input.

System Config path: Authentication > OAuth 2.0 (or GitLab) config.json setting: GitLabSettings > Id Environment variable: MM_GITLABSETTINGS_ID

iNote

GitLab provides the Application Secret Key along with the the ID.

GitLab OAuth 2.0 Application secret key

This setting holds the OAuth Application Secret Key from GitLab. The key is generated at the same time as the Application ID (see GitLab OAuth 2.0 Application ID). Enter the key provided by GitLab in the Mattermost System Console field, config.json setting, or Environment variable. String input.

System Config path: Authentication > OAuth 2.0 (or GitLab) config.json setting: GitLabSettings > Secret Environment variable: MM_GITLABSETTINGS_SECRET

GitLab OAuth 2.0 site URL

This setting holds the URL of your GitLab instance, e.g. https://example.com:3000. Use http:// if SSL is not enabled on your GitLab instance.

System Config path: Authentication > OAuth 2.0 (or GitLab) config.json setting: N/A Environment variable: N/A

GitLab OAuth 2.0 User API endpoint

This setting holds the URL of your GitLab User API endpoint, e.g. https://<your-gitlab-url>/api/v3/user. Use http:// if SSL is not enabled on your GitLab instance. Enter the URL in the Mattermost System Console field, config.json setting, or Environment variable. String input.

System Config path: Authentication > OAuth 2.0 (or GitLab) config.json setting: GitLabSettings > UserAPIEndpoint Environment variable: MM_GITLABSETTINGS_USERAPIENDPOINT

GitLab OAuth 2.0 Auth endpoint

This setting holds the URL of your GitLab Auth endpoint, e.g. https://<your-gitlab-url>/oauth/authorize. Use http:// if SSL is not enabled on your GitLab instance. Enter the URL in the Mattermost System Console field, config.json setting, or Environment variable. String input.

System Config path: Authentication > OAuth 2.0 (or GitLab) config.json setting: GitLabSettings > AuthEndpoint Environment variable: MM_GITLABSETTINGS_AUTHENDPOINT

GitLab OAuth 2.0 Token endpoint

This setting holds the URL of your GitLab OAuth Token endpoint, e.g. https://<your-gitlab-url>/oauth/token. Use http:// if SSL is not enabled on your GitLab instance. Enter the URL in the Mattermost System Console field, config.json setting, or Environment variable. String input.

System Config path: Authentication > OAuth 2.0 (or GitLab) config.json setting: GitLabSettings > TokenEndpoint Environment variable: MM_GITLABSETTINGS_TOKENENDPOINT

Google OAuth 2.0 settings

Enable OAuth 2.0 authentication with Google

true: Allows team and account creation using Google OAuth authentication. Input the Client ID and Client Secret credentials to configure. | - System Config path: Authentication > OAuth 2.0 | - false: (Default) Disables Google OAuth authentication. | - config.json setting: GoogleSettings > Enable > false| - Environment variable: MM_GOOGLESETTINGS_ENABLE | See Google Single Sign-On implementation instructions. |

Google OAuth 2.0 Client ID

This setting stores the OAuth Client ID from Google. Generate the ID by going to the Credentials section of the Google Cloud Platform APIs & Services menu and selecting Create Credentials > OAuth client ID. | - System Config path: Authentication > OAuth 2.0 | - config.json setting: GoogleSettings > Id| See Google Single Sign-On for instructions that can be used to implement Google OAuth or OpenID authentication. | - Environment variable: MM_GOOGLESETTINGS_ID                                                       | String input. | |

Google OAuth 2.0 Client secret

This setting stores the OAuth Client Secret from Google. The Secret is generated at the same time as the Client ID. String input.

System Config path: Authentication > OAuth 2.0 config.json setting: GoogleSettings > Secret Environment variable: MM_GOOGLESETTINGS_SECRET

Google OAuth 2.0 User API endpoint

We recommend https://people.googleapis.com/v1/people/me?personFields=names,emailAddresses,nicknames,metadata as the User API Endpoint. Otherwise, enter a custom endpoint in config.json with HTTP, or HTTPS, if available on the API server. String input.

System Config path: Authentication > OAuth 2.0 config.json setting: GoogleSettings > UserAPIEndpoint Environment variable: MM_GOOGLESETTINGS_USERAPIENDPOINT

Google OAuth 2.0 Auth endpoint

We recommend https://accounts.google.com/o/oauth2/v2/auth as the Auth Endpoint. Otherwise, enter a custom endpoint in config.json with HTTP, or HTTPS, if available on the server. String input.

System Config path: Authentication > OAuth 2.0 config.json setting: GoogleSettings > AuthEndpoint Environment variable: MM_GOOGLESETTINGS_AUTHENDPOINT

Google OAuth 2.0 Token endpoint

We recommend https://www.googleapis.com/oauth2/v4/token as the Token Endpoint. Otherwise, enter a custom endpoint in config.json with HTTP, or HTTPS, if available on the server. String input.

System Config path: Authentication > OAuth 2.0 config.json setting: GoogleSettings > TokenEndpoint Environment variable: MM_GOOGLESETTINGS_TOKENENDPOINT

Entra ID OAuth 2.0 settings

iNote

In line with Microsoft ADFS guidance we recommend configuring intranet forms-based authentication for devices that do not support WIA.

Enable OAuth 2.0 Authentication with Entra ID

true: Allows team and account creation using Entra ID OAuth authentication. false: (Default) Disables Entra ID OAuth authentication.

System Config path: Authentication > OAuth 2.0 config.json setting: Office365Settings > Enable > false Environment variable: MM_OFFICE365SETTINGS_ENABLE

iNote

See the Entra ID Single Sign-On documentation for details.

Entra ID OAuth 2.0 Application ID

This setting holds the Application ID generated when configuring Entra ID as a Single Sign-On service through the Microsoft Azure Portal. String input.

System Config path: Authentication > OAuth 2.0 config.json setting: Office365Settings > Id Environment variable: MM_OFFICE365SETTINGS_ID

iNote

See the Entra ID Single Sign-On documentation for details.

Entra ID OAuth 2.0 Application secret password

This setting holds the Application Secret Password generated when configuring Entra ID as a Single Sign-On service through the Microsoft Azure Portal. String input.

System Config path: Authentication > OAuth 2.0 config.json setting: Office365Settings > Secret Environment variable: MM_OFFICE365SETTINGS_SECRET

iNote

See the Entra ID Single Sign-On documentation for details.

Entra ID OAuth 2.0 Directory (tenant) ID

This setting holds the Directory (tenant) ID set for Mattermost through the Azure Portal. String input.

System Config path: Authentication > OAuth 2.0 config.json setting: Office365Settings > DirectoryId Environment variable: MM_OFFICE365SETTINGS_DIRECTORYID

iNote

See the Entra ID Single Sign-On documentation for details.

Entra ID OAuth 2.0 User API endpoint

We recommend https://graph.microsoft.com/v1.0/me as the User API Endpoint. Otherwise, enter a custom endpoint in config.json with http, or https, if available on the server. String input.

System Config path: Authentication > OAuth 2.0 config.json setting: Office365Settings > UserAPIEndpoint Environment variable: MM_OFFICE365SETTINGS_USERAPIENDPOINT

Entra ID OAuth 2.0 Auth endpoint

We recommend https://login.microsoftonline.com/common/oauth2/v2.0/authorize as the Auth Endpoint. Otherwise, enter a custom endpoint in config.json with http, or https, if available on the server. String input.

System Config path: Authentication > OAuth 2.0 config.json setting: Office365Settings > AuthEndpoint Environment variable: MM_OFFICE365SETTINGS_AUTHENDPOINT

Entra ID OAuth 2.0 Token endpoint

We recommend https://login.microsoftonline.com/common/oauth2/v2.0/token as the Token Endpoint. Otherwise, enter a custom endpoint in config.json with http, or https, if available on the server. String input.

System Config path: Authentication > OAuth 2.0 config.json setting: Office365Settings > TokenEndpoint Environment variable: MM_OFFICE365SETTINGS_TOKENENDPOINT

---

OpenID Connect

Access the following configuration settings in the System Console by going to Authentication > OpenID Connect.

Select OpenID Connect service provider

Use this setting to enable OpenID Connect, with these options: Do not allow login via an OpenID provider GitLab (see settings) Google Apps (see settings) Entra ID (see settings) OpenID Connect (Other) (see settings)

System Config path: Authentication > OpenID Connect config.json setting: N/A Environment variable: N/A

iNote

GitLab OpenID is available in all plans. All other providers require Mattermost Enterprise or Professional.

GitLab OpenID settings

Enable OpenID Connect authentication with GitLab

true: Allows team and account creation using GitLab OpenID Connect authentication. false: (Default) Disables GitLab OpenID Connect authentication.

System Config path: Authentication > OpenID Connect config.json setting: GitLabSettings > Enable > false Environment variable: MM_GITLABSETTINGS_ENABLE

iNote

See the GitLab Single Sign-On documentation for details.

GitLab OpenID site URL

This setting stores the URL of your GitLab instance, e.g. https://example.com:3000. String input.

System Config path: Authentication > OpenID Connect config.json setting: N/A Environment variable: N/A

iNote

See Step 2 of the GitLab Single Sign-On documentation for details.

GitLab OpenID Discovery endpoint

This setting is prepopulated with the Discovery Endpoint for GitLab OpenID Connect. String input. Default is https://gitlab.com/.well-known/openid-configuration

System Config path: Authentication > OpenID Connect config.json setting: GitLabSettings > DiscoveryEndpoint Environment variable: MM_GITLABSETTINGS_DISCOVERYENDPOINT

iNote

See Step 2 of the GitLab Single Sign-On documentation for details.

GitLab OpenID Client ID

This setting stores the Application ID generated by GitLab. String input.

System Config path: Authentication > OpenID Connect config.json setting: GitLabSettings > Id Environment variable: MM_GITLABSETTINGS_ID

iNote

See Step 2 of the GitLab Single Sign-On documentation for details.

GitLab OpenID Client secret

This setting stores the Application Secret Key generated by GitLab. String input.

System Config path: Authentication > OpenID Connect config.json setting: GitLabSettings > Secret Environment variable: MM_GITLABSETTINGS_SECRET

iNote

See Step 2 of the GitLab Single Sign-On documentation for details.

GitLab OpenID use preferred username

true: Mattermost uses the preferred_username claim from the GitLab OpenID token as the Mattermost | - System Config path: Authentication > OpenID Connect | username. | - config.json setting: GitLabSettings > UsePreferredUsername > false false: (Default) Mattermost does not use the preferred_username claim for username assignment. | - Environment variable: MM_GITLABSETTINGS_USEPREFERREDUSERNAME

Google OpenID settings

Enable OpenID Connect authentication with Google

• true: Allow team creation and account signup using Google OpenID Connect.
• false: (Default) Google OpenID Connect cannot be used for team creation or account signup.

true: Allows team and account creation using Google OpenID authentication. | - System Config path: Authentication > OpenID Connect | - false: (Default) Disables Google OpenID authentication. | - config.json setting: GoogleSettings > Enable > false | - Environment variable: MM_GOOGLESETTINGS_ENABLE | See Google Single Sign-On implementation instructions. |

Google OpenID Discovery endpoint

This setting is prepopulated with the Discovery Endpoint for Google OpenID Connect. | - System Config path: Authentication > OpenID Connect | - config.json setting: GoogleSettings > DiscoveryEndpoint | See Configure Mattermost for Google Apps SSO. | - Environment variable: MM_GOOGLESETTINGS_DISCOVERYENDPOINT                                                                       | String input. Default is https://accounts.google.com/.well-known/openid-configuration | |

Google OpenID Client ID

This setting stores the Client ID generated by Google. | - System Config path: Authentication > OpenID Connect | - config.json setting: GoogleSettings > Id | See Google Single Sign-On implementation instructions. | - Environment variable: MM_GOOGLESETTINGS_ID                                                           | String input. | |

Google OpenID Client secret

This setting stores the Client Secret generated by Google. | - System Config path: Authentication > OpenID Connect | - config.json setting: GoogleSettings > Secret| See Google Single Sign-On implementation instructions. | - Environment variable: MM_GOOGLESETTINGS_SECRET                                                           | String input. | |

Google OpenID use preferred username

true: Mattermost uses the preferred_username claim from the Google OpenID token as the Mattermost | - System Config path: Authentication > OpenID Connect | username. | - config.json setting: GoogleSettings > UsePreferredUsername > false false: (Default) Mattermost does not use the preferred_username claim for username assignment. | - Environment variable: MM_GOOGLESETTINGS_USEPREFERREDUSERNAME

Entra ID OpenID settings

iNote

In line with Microsoft ADFS guidance, we recommend configuring intranet forms-based authentication for devices that do not support WIA.

Enable OpenID Connect authentication with Entra ID

true: Allows team and account creation using Entra ID OpenID Connect authentication. | - System Config path: Authentication > OpenID Connect | - false: (Default) Disables Entra ID OpenID Connect authentication. | - config.json setting: Office365Settings > Enable > false | - Environment variable: MM_OFFICE365SETTINGS_ENABLE | See Entra ID Single Sign-On implementation instructions. |

Entra ID OpenID Directory (tenant) ID

This setting holds the Directory (tenant) ID set for Mattermost through the Microsoft Azure Portal. | - System Config path: Authentication > OpenID Connect | - config.json setting: Office365Settings > DirectoryId | See Entra ID Single Sign-On implementation instructions. | - Environment variable: MM_OFFICE365SETTINGS_DIRECTORYID                                                                    | String input. | |

Entra ID OpenID Discovery endpoint

This setting is prepopulated with the Discovery Endpoint for Entra ID OpenID Connect. | - System Config path: Authentication > OpenID Connect | - config.json setting: Office365Settings > DiscoveryEndpoint | See Entra ID Single Sign-On implementation instructions. | - Environment variable: MM_OFFICE365SETTINGS_DISCOVERYENDPOINT                                                                                                                    | String input. Default is https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration | |

Entra ID Client ID

This setting stores the Application (client) ID generated through the Microsoft Azure Portal. | - System Config path: Authentication > OpenID Connect | - config.json setting: Office365Settings > Id | See Entra ID Single Sign-On implementation instructions. | - Environment variable: MM_OFFICE365SETTINGS_ID                                                           | String input. | |

Entra ID Client secret

This setting stores the Client Secret generated through the Microsoft Azure Portal. | - System Config path: Authentication > OpenID Connect | - config.json setting: Office365Settings > Secret | See Entra ID Single Sign-On implementation instructions. | - Environment variable: MM_OFFICE365SETTINGS_SECRET                                                                | String input. | |

Entra ID use preferred username

true: Mattermost uses the preferred_username claim from the Entra ID OpenID token as the Mattermost username. | - System Config path: Authentication > OpenID Connect | false: (Default) Mattermost does not use the preferred_username claim for username assignment. | - config.json setting: Office365Settings > UsePreferredUsername > false - Environment variable: MM_OFFICE365SETTINGS_USEPREFERREDUSERNAME

iNote

To make the preferred_username claim available, add it as an optional claim in the Azure Portal under App registrations > Token configuration. See Entra ID Single Sign-On for setup details.

OpenID Connect (other) settings

Enable OpenID Connect authentication with other service providers

true: Allows team and account creation using other OpenID Connect service providers. | - System Config path: Authentication > OpenID Connect | - false: (Default) Disables OpenID Connect authentication with other service providers. | - config.json setting: OpenIdSettings > Enable > false | - Environment variable: MM_OPENIDSETTINGS_ENABLE | See OpenID Connect Single Sign-On implementation instructions. |

OpenID Connect (other) Button name

This setting is the text for the OpenID login button. String input.

System Config path: Authentication > OpenID Connect config.json setting: OpenIdSettings > ButtonText Environment variable: MM_OPENIDSETTINGS_BUTTONTEXT

OpenID Connect (other) Button color

This setting is the color of the OpenID login button. Use a hex code with a #-sign before the code, for example #145DBF. String input.

System Config path: Authentication > OpenID Connect config.json setting: OpenIdSettings > ButtonColor Environment variable: MM_OPENIDSETTINGS_BUTTONCOLOR

OpenID Connect (other) Discovery endpoint

This setting stores the Discovery Endpoint URL from the OpenID provider. | - System Config path: Authentication > OpenID Connect | The URL should be in the format of https://myopenid.provider.com/{my_organization}/ | -config.jsonsetting:OpenIdSettings>DiscoveryEndpoint| .well-known/openid-configuration. | - Environment variable: MM_OPENIDSETTINGS_DISCOVERYENDPOINT | | | See OpenID Connect Single Sign-On | implementation instructions. | | | | String input. | |

iNote

The Discovery Endpoint setting can be used to determine the connectivity and availability of arbitrary hosts. System admins concerned about this can use custom admin roles to limit access to modifying these settings. See the delegated granular administration) documentation for details.

OpenID Connect (other) Client ID

This setting stores the Client ID from the OpenID provider. | - System Config path: Authentication > OpenID Connect | - config.json setting: OpenIdSettings > Id | See OpenID Connect Single Sign-On implementation instructions. | - Environment variable: MM_OPENIDSETTINGS_ID                                                           | String input. | |

OpenID Connect (other) Client secret

This setting stores the Client Secret from the OpenID provider. | - System Config path: Authentication > OpenID Connect | - config.json setting: OpenIdSettings > Secret| See OpenID Connect Single Sign-On implementation instructions. | - Environment variable: MM_OPENIDSETTINGS_SECRET                                                           | String input. | |

OpenID Connect (other) use preferred username

true: Mattermost uses the preferred_username claim from the provider's OpenID token as the Mattermost username. false: (Default) Mattermost does not use the preferred_username claim for username assignment.

System Config path: Authentication > OpenID Connect | config.json setting: OpenIdSettings > | UsePreferredUsername > false | Environment variable: | MM_OPENIDSETTINGS_USEPREFERREDUSERNAME

---

Guest access

Access the following configuration settings in the System Console by going to Authentication > Guest Access.

Enable guest access

true: Enables the guest account feature. false: (Default) Disables the guest account feature.

System Config path: Authentication > Guest Access config.json setting: GuestAccountsSettings > Enable > false Environment variable: MM_GUESTACCOUNTSSETTINGS_ENABLE

iNote

Guest billing depends on channel access. Guests in exactly one active channel are treated as single-channel guests and don't count toward the primary paid seat count. They're free up to a 1:1 ratio with licensed seats. Guests in multiple active channels continue to count as activated users for billing purposes. Direct messages and group messages don't affect whether a guest is counted as a single-channel guest. Only active channels count toward guest channel access for billing. Archived channels are excluded. See the guest accounts documentation for full details.

Whitelisted guest domains

Use this setting to restrict the creation of guest accounts. When set, guest accounts require a verified email address from one of the listed domains. String input of one or more domains, separated by commas.

System Config path: Authentication > Guest Access config.json setting: GuestAccountsSettings > RestrictCreationToDomains Environment variable: MM_GUESTACCOUNTSSETTINGS_RESTRICTCREATIONTODOMAINS

Show guest tag

true: (Default) Guest tags are visible in Mattermost. false: Guest tags aren't visible in Mattermost.

System Config path: Authentication > Guest Access config.json setting: GuestAccountsSettings > HideTags > true Environment variable: MM_GUESTACCOUNTSSETTINGS_HIDETAGS

iNote

This configuration setting applies to all Mattermost clients, including web, desktop app, and mobile app. See the guest accounts documentation for details.

Enable guest magic link authentication

Available on Entry, Enterprise, and Enterprise Advanced plans (not available on Professional) plans

true: Enables magic link passwordless authentication for guest users. false: (Default) Magic link authentication for guest users is disabled.

System Config path: Authentication > Guest Access config.json setting: GuestAccountsSettings > EnableGuestMagicLink > false

iNote

See the guest accounts documentation for guest user setup details.