[GH-ISSUE #3630] Login without IdP (username/password or passkey) #7753

Open
opened 2026-08-05 01:14:24 -04:00 by saavagebueno · 9 comments
Owner

Originally created by @markcst on GitHub (Apr 7, 2025).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/3630

Is your feature request related to a problem? Please describe.
This is not a problem, but more of a common sense request to run Netbird on even less powerful servers

Describe the solution you'd like
Implement access without mandatory IDP, but with simple username and password

Login without an IDP
Hi Netbird team,

First of all, thank you for the amazing work on Netbird — it's a great tool and I really appreciate the effort going into it.

I’d like to request support for an alternative authentication method that does not rely on an external Identity Provider (IDP). Specifically, I’d love to see the ability to log in with either:

  • A simple username and password
  • A passkey or other lightweight, secure method

One of the main motivations behind this request is performance: IDP solutions often introduce significant CPU overhead, which is a concern, especially on lower-powered devices or embedded systems. For certain use cases, minimizing CPU usage is critical.

To be clear, I'm not suggesting removing support for IDPs — it’s absolutely great that Netbird integrates with them. I just believe that offering a non-IDP option would be very beneficial for users who need a simpler, more resource-efficient setup.

Thanks for considering this enhancement!

Originally created by @markcst on GitHub (Apr 7, 2025). Original GitHub issue: https://github.com/netbirdio/netbird/issues/3630 **Is your feature request related to a problem? Please describe.** This is not a problem, but more of a common sense request to run Netbird on even less powerful servers **Describe the solution you'd like** Implement access without mandatory IDP, but with simple username and password **Login without an IDP** Hi Netbird team, First of all, thank you for the amazing work on Netbird — it's a great tool and I really appreciate the effort going into it. I’d like to request support for an alternative authentication method that does not rely on an external Identity Provider (IDP). Specifically, I’d love to see the ability to log in with either: - A simple username and password - A passkey or other lightweight, secure method One of the main motivations behind this request is **performance**: IDP solutions often introduce significant CPU overhead, which is a concern, especially on lower-powered devices or embedded systems. For certain use cases, minimizing CPU usage is critical. To be clear, I'm not suggesting removing support for IDPs — it’s absolutely great that Netbird integrates with them. I just believe that offering a **non-IDP option** would be very beneficial for users who need a simpler, more resource-efficient setup. Thanks for considering this enhancement!
saavagebueno added the feature-request label 2026-08-05 01:14:24 -04:00
Author
Owner

@nazarewk commented on GitHub (Apr 7, 2025):

I don't think we will get enough traction to implement a user management system on the backend.

I'm not sure what Zitadel setup looks like, but I'm pretty sure Dex with a static list of users would be light on resources and easy to set up.

<!-- gh-comment-id:2783600028 --> @nazarewk commented on GitHub (Apr 7, 2025): I don't think we will get enough traction to implement a user management system on the backend. I'm not sure what Zitadel setup looks like, but I'm pretty sure Dex with a [static list of users](https://dexidp.io/docs/connectors/local/#static-configuration-config-file) would be light on resources and easy to set up.
Author
Owner

@jahidhsn002 commented on GitHub (Apr 21, 2025):

I absolutely love to see netbird with it's own authication with user & pass setup ...

<!-- gh-comment-id:2819993090 --> @jahidhsn002 commented on GitHub (Apr 21, 2025): I absolutely love to see netbird with it's own authication with user & pass setup ...
Author
Owner

@markcst commented on GitHub (Jun 16, 2025):

I don't think we will get enough traction to implement a user management system on the backend.

I'm not sure what Zitadel setup looks like, but I'm pretty sure Dex with a static list of users would be light on resources and easy to set up.

Zitadel is good, but it is quite heavy...

How does Dexidp set up to do everything locally - without using Google or other managed IDPs - as well as I currently have Zitadel*?

*(I followed the procedure for using Zitadel on the official advanced doc for Netbird selfhosted)

<!-- gh-comment-id:2976529923 --> @markcst commented on GitHub (Jun 16, 2025): > I don't think we will get enough traction to implement a user management system on the backend. > > I'm not sure what Zitadel setup looks like, but I'm pretty sure Dex with a [static list of users](https://dexidp.io/docs/connectors/local/#static-configuration-config-file) would be light on resources and easy to set up. > Zitadel is good, but it is quite heavy... How does Dexidp set up to do everything locally - without using Google or other managed IDPs - as well as I currently have Zitadel*? *(I followed the procedure for using Zitadel on the official advanced doc for Netbird selfhosted)
Author
Owner

@bornav commented on GitHub (Dec 14, 2025):

I would just like to add to this, this would be needed if netbird is managing network where the IDP resides is, in my case the network would need to set up properly before it can be used, but in case of cold deployment, it would be impossible to use, so something along the line of a master token or similar where you could still join a network when IDP is down/unreachable but when available, use it.

<!-- gh-comment-id:3650469446 --> @bornav commented on GitHub (Dec 14, 2025): I would just like to add to this, this would be needed if netbird is managing network where the IDP resides is, in my case the network would need to set up properly before it can be used, but in case of cold deployment, it would be impossible to use, so something along the line of a master token or similar where you could still join a network when IDP is down/unreachable but when available, use it.
Author
Owner

@markcst commented on GitHub (Dec 14, 2025):

Let me add to this that I've recently discovered that one could use just setup keys without passing through an IdP, but that just works for peers when logging in/accessing the mesh net, and sadly not the management layer, which by design requires, for what I've understood, always an IdP to be accessed and used (the dashboard aka web-ui is just a view of the management layer).

And now that #2503 addresses the setup key usage on almost (can confirm that on Android already works) all NetBird clients, I think this would be the last piece to complete the puzzle, making all NetBird features completely accessible without relying on an IdP (which could be resource demanding, especially on low power harware).

I know we haven't things like user/password or passkey authentication yet, but at least we could have a "mid-way", using, indeed, the setup key system for that.

This could be a huge step forward in supporting devices with medium to low resource consumption, and I hope developers will take this into account

<!-- gh-comment-id:3650486691 --> @markcst commented on GitHub (Dec 14, 2025): Let me add to this that I've recently discovered that one could use just setup keys without passing through an IdP, but that just works for peers when logging in/accessing the mesh net, and sadly not the management layer, which by design requires, for what I've understood, always an IdP to be accessed and used (the dashboard aka web-ui is just a view of the management layer). And now that #2503 addresses the setup key usage on almost (can confirm that on Android already works) all NetBird clients, I think this would be the last piece to complete the puzzle, making all NetBird features completely accessible without relying on an IdP (which could be resource demanding, especially on low power harware). I know we haven't things like user/password or passkey authentication yet, but at least we could have a "mid-way", using, indeed, the setup key system for that. This could be a huge step forward in supporting devices with medium to low resource consumption, and I hope developers will take this into account
Author
Owner

@szlend commented on GitHub (Jan 1, 2026):

Another reason why people might want this is to not have to publicly expose the IdP server, which right now is a requirement to authenticate to the VPN in the first place.

<!-- gh-comment-id:3704051299 --> @szlend commented on GitHub (Jan 1, 2026): Another reason why people might want this is to not have to publicly expose the IdP server, which right now is a requirement to authenticate to the VPN in the first place.
Author
Owner

@braginini commented on GitHub (Jan 1, 2026):

Hey everyone, I'm currently working on a direct integration of DEX into NetBird here. I already have a working version and it will be released soon.

The main idea of this project is to remove the IdP configuration complexity (you'll be able to configure a number of OIDC providers if you want to) and to log in with username and password.

<!-- gh-comment-id:3704081045 --> @braginini commented on GitHub (Jan 1, 2026): Hey everyone, I'm currently working on a direct integration of DEX into NetBird [here](https://github.com/netbirdio/netbird/pull/5008). I already have a working version and it will be released soon. The main idea of this project is to remove the IdP configuration complexity (you'll be able to configure a number of OIDC providers if you want to) and to log in with username and password.
Author
Owner

@markcst commented on GitHub (Jan 1, 2026):

Hey everyone, I'm currently working on a direct integration of DEX into NetBird here. I already have a working version and it will be released soon.

The main idea of this project is to remove the IdP configuration complexity (you'll be able to configure a number of OIDC providers if you want to) and to log in with username and password.

Awesome, @braginini, thanks for working on this!
Since this feature originated also from this request, would you mind adding a small mention like “requested by @markcst” or a reference to this issue in the changelog or release notes?
Totally fine either way — just asking 🙂

<!-- gh-comment-id:3704087260 --> @markcst commented on GitHub (Jan 1, 2026): > Hey everyone, I'm currently working on a direct integration of DEX into NetBird here. I already have a working version and it will be released soon. > > The main idea of this project is to remove the IdP configuration complexity (you'll be able to configure a number of OIDC providers if you want to) and to log in with username and password. Awesome, @braginini, thanks for working on this! Since this feature originated also from this request, would you mind adding a small mention like “requested by @markcst” or a reference to this issue in the changelog or release notes? Totally fine either way — just asking 🙂
Author
Owner

@braginini commented on GitHub (Jan 1, 2026):

Hey everyone, I'm currently working on a direct integration of DEX into NetBird here. I already have a working version and it will be released soon.
The main idea of this project is to remove the IdP configuration complexity (you'll be able to configure a number of OIDC providers if you want to) and to log in with username and password.

Awesome, @braginini, thanks for working on this! Since this feature originated also from this request, would you mind adding a small mention like “requested by @markcst” or a reference to this issue in the changelog or release notes? Totally fine either way — just asking 🙂

We’re introducing this feature for several reasons, with community feedback and improved usability at the top of the list. I’ll link it to the PR and make sure to mention you in the release notes as well as someone who provided valuable feedback :)

<!-- gh-comment-id:3704099889 --> @braginini commented on GitHub (Jan 1, 2026): > > Hey everyone, I'm currently working on a direct integration of DEX into NetBird here. I already have a working version and it will be released soon. > > The main idea of this project is to remove the IdP configuration complexity (you'll be able to configure a number of OIDC providers if you want to) and to log in with username and password. > > Awesome, [@braginini](https://github.com/braginini), thanks for working on this! Since this feature originated also from this request, would you mind adding a small mention like “requested by [@markcst](https://github.com/markcst)” or a reference to this issue in the changelog or release notes? Totally fine either way — just asking 🙂 We’re introducing this feature for several reasons, with community feedback and improved usability at the top of the list. I’ll link it to the PR and make sure to mention you in the release notes as well as someone who provided valuable feedback :)
Sign in to join this conversation.
No Label feature-request
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#7753