# Local Authentication

After installing Kloudfuse, add users and manage their credentials.

|     |     |
| --- | --- |
|  | The user appears in the **Admin > Users** tab _after_ they log in for the first time. |

Follow these steps:

1. Connect to your Kloudfuse Kubernetes cluster.

2. Remove any existing local copy of the `users.txt` file:

```console
rm -f users.txt
```

3. Retrieve the current `users.txt` from the `kfuse-auth-users` secret and save it locally. The file uses [htpasswd](https://httpd.apache.org/docs/current/programs/htpasswd.html) format.

```console
kubectl get secret -n kfuse kfuse-auth-users -o json | jq -r '.data."users.txt"' | base64 -d > users.txt
```

If the secret does not exist yet, create a new empty `users.txt` file.

4. (Optional) If changing the password of an existing user, remove that user’s entry from `users.txt`.

5. Create or update the user’s password.

This example is for user `testuser`. For the admin user, use `admin`.

```console
htpasswd -Bn testuser >> users.txt
```

|     |     |
| --- | --- |
|  | `htpasswd` accepts empty passwords. Ensure that you provide a non-empty password when prompted after running the above command. |

1. Ensure that `users.txt` has no blank lines between entries:

```console
sed -i '' '/^$/d' users.txt
```

2. Ensure that `users.txt` ends with a newline:

```console
echo "" >> users.txt
```

3. Encode `users.txt` in base64:

```console
cat users.txt | base64
```

4. Update the `kfuse-auth-users` Kubernetes secret with the base64-encoded value:

```console
kubectl edit secret kfuse-auth-users
```

Set the `users.txt` field to the output of the previous step.

If the secret does not exist, create it:

```yaml
apiVersion: v1
data:
     users.txt: |-
       <base64-encoded-value>
kind: Secret
metadata:
     name: kfuse-auth-users
type: Opaque
```

5. For fresh installations, update your `custom-values.yaml` to reference the `kfuse-auth-users` secret:

```yaml
kfuse-auth:
     oauth2-proxy:
       htpasswdFile:
         existingSecret: kfuse-auth-users
```

Skip this step when adding a new user or updating the password of an existing user.

6. Restart the `kfuse-auth` deployment to apply the changes:

```console
kubectl -n kfuse rollout restart deployment kfuse-auth
```

7. After logging in with the new credentials for the first time, the user appears in the **Admin > Users** interface.