Authentication & Access

🔐 Authentication & Access link

Central Set Go (CSGO) provides a unified authentication system used consistently across:

• The Admin UI
• The REST API
• External integrations and automation

This section documents each authentication-related feature with:

• The UI screen
• The user workflow
• The exact API call backing that screen

🧠 The Admin UI is just another API client.
Everything you can do in the UI can be done programmatically.

Login link

The login process authenticates a user and returns a JWT token used for all subsequent API requests.

  
POST /dyn_api/login/login
  

  Content-Type: application/json
  

  {
  "lang": "pt",
  "data": {
    "username": "root",
    "password": "1234"
  }
}
  

  {
  "success": true,
  "token": "<JWT_TOKEN>",
  "user": {
    "user_id": 1,
    "username": "root",
    "first_name": "Super",
    "last_name": "Admin",
    "email": "root@domain.com",
    "role_id": 1,
    "lang_id": 1
  }
}
  

  Authorization: Bearer <JWT_TOKEN>
  

Change Password link

Users can change their own password from the UI or via the API.

  POST /dyn_api/login/alter_password
  

  Content-Type: application/json
Authorization: Bearer <JWT_TOKEN>
  

  {
  "lang": "en",
  "data": {
    "old_password": "1234",
    "new_password": "new_secure_password"
  }
}
  

  {
  "success": true,
  "message": "Password updated successfully"
}
  

API Access & Tokens link

CSGO uses JWT-based authentication for all protected endpoints.

• Tokens are issued at login

• Tokens encode:

  • User ID
  • Username
  • Role assignments
  • Permissions

• Token expiration is configurable

Using the Token link

All authenticated requests must include:

  Authorization: Bearer <JWT_TOKEN>
  

Security Model link

• UI and API share the same RBAC rules
• Permissions are enforced server-side
• Tokens cannot bypass UI restrictions

LDAP Authentication (Optional) link

Central Set Go supports direct authentication against an LDAP directory instead of the internal users table.

When LDAP authentication is enabled:

• The Login UI remains exactly the same
• The Login API endpoint remains exactly the same
• Credentials are validated against LDAP
• User records are resolved dynamically, not stored locally
• Roles and permissions are still managed inside CSGO

🔁 UI and API do not change — only the authentication backend does.

How LDAP Authentication Works link

1. A user submits credentials via:

   • Login UI or
   • POST /dyn_api/login/login

2. CSGO validates credentials against the configured LDAP server

3. If authentication succeeds:

   • A JWT token is issued
   • The user session behaves like a normal CSGO user

4. Authorization (roles, permissions) is still enforced by CSGO

Enabling LDAP Authentication link

LDAP authentication is enabled entirely via environment variables.

.env Configuration link

  # Enable / Disable LDAP authentication
USE_LDAP_AUTH=false

# LDAP connection
LDAP_URL=ldap://localhost:1389
LDAP_BIND_USER=cn=admin,dc=example,dc=com
LDAP_PASSWORD=admin
LDAP_BASE_DN=dc=example,dc=com

# TLS / certificate behavior
LDAP_SKIP_VERIFY_CERT=true

# User lookup filter
LDAP_SEARCHREQ_FILTER="(|(uid=%[1]s)(cn=%[1]s)(mail=%[1]s))"
  

Key Variables Explained link

Login Flow with LDAP Enabled link

  POST /dyn_api/login/login
  

  {
  "lang": "en",
  "data": {
    "username": "jdoe",
    "password": "secret"
  }
}
  

Authorization with LDAP Users link

LDAP handles authentication only.

CSGO remains responsible for:

• Roles
• Permissions
• App / menu / table access
• API authorization

This allows you to:

• Centralize identity in LDAP

• Keep fine-grained access control inside CSGO

• Use the same RBAC model for:

  • Local users
  • LDAP users
  • Service tokens

Tested LDAP Setup link

LDAP authentication has been tested using:

• LDAP Server osixia/openldap:1.5.0

• LDAP Admin UI osixia/phpldapadmin:0.9.0

Both managed via Docker.

This setup is suitable for:

• Local development
• Testing
• Integration with enterprise LDAP-compatible directories

Summary link

CSGO authentication supports:

• ✅ Local users (database-backed)
• ✅ LDAP-backed authentication
• ✅ Unified UI and API login flow
• ✅ JWT-based sessions
• ✅ Centralized authorization

🔧 Switch authentication backends without changing your UI or API clients.

Next link

👉 Security & Permissions Learn how roles, permissions, and table-level access control apply to both local and LDAP-authenticated users.