How do I disable local user accounts in Chef Automate Dex and enforce authentication only via LDAP or SAML?

Chef Automate uses Dex as its identity service to manage authentication via OpenID Connect. Dex supports integration with external identity providers such as LDAP and SAML, alongside local user accounts.

To enforce centralised identity management and enhance security, you can disable local user accounts by setting the following in your Dex configuration:

TOML Configuration:

[dex.v1.sys.connectors]
disable_local_users = true

This disables the creation and use of local Dex accounts. Once enabled, only users authenticated via LDAP or SAML will be able to access Chef Automate.

Important Requirement:
This setting can only be enabled if a fully functional LDAP or SAML setup is already in place.
If a suitable LDAP or SAML configuration is not detected, the action will be rejected and Dex will not apply the change.

This configuration is commonly used in enterprise environments to align with security and compliance policies. It must be tested carefully to avoid authentication lockouts.

If external identity providers are not yet configured, retain local user access until LDAP or SAML is ready.

This setting is part of a broader strategy to enforce federated authentication and eliminate unmanaged local accounts. It is recommended to validate external identity provider readiness before deployment.