Disable the local admin account after SSO setup

After configuring single sign-on (SSO) for vCluster Platform, disabling the local admin account is a recommended security practice for enterprise environments. This prevents unauthorized access through the default credentials and ensures all authentication flows through your identity provider.

Prerequisites

Before disabling the local admin account:

• SSO is configured and tested successfully
• At least one SSO user has global admin permissions
• You have verified SSO login works with the expected permissions
• You have kubectl access to the cluster running vCluster Platform

Verify SSO access first

Ensure you can log in using SSO with global admin permissions before disabling the local admin. Locking yourself out requires recovery steps.

Disable the admin account

There are two steps to fully disable the local admin:

1. Lock the admin user in the UI
2. Prevent the admin from being recreated on startup

Lock the admin user

1. Log in to vCluster Platform using your SSO credentials with global admin permissions.

2. Go to Platform > Users & Roles.

3. In the admin user row, click the actions menu and select Lock User.

The admin account is now locked. The user cannot log in and any access keys generated for the admin will stop working.

Prevent admin recreation on startup

To prevent the platform from recreating a missing admin when an instance becomes leader, update the values file that manages your platform release:

vcluster-platform-values.yaml

admin:
  create: false

Apply the configuration:

helm upgrade vcluster-platform loft/vcluster-platform \
  --namespace vcluster-platform \
  --values vcluster-platform-values.yaml

note

If the values file contains admin credentials, remove them after you lock the account. Keep all other custom release values in the file. Leaving stale credentials in configuration files is a security risk.

Recovery

Admin password recovery doesn't unlock a locked account. If SSO becomes unavailable, restore it or use an existing authenticated global admin session. Then complete these steps:

1. Go to Platform > Users & Roles.

2. In the admin user row, click the actions menu and select Unlock User.

3. Re-enable password authentication if it was disabled. Generate a new configuration with password login enabled:

   kubectl get secrets/loft-manager-config -n vcluster-platform \
     -o jsonpath="{.data.config}" | base64 -d | \
     yq "del(.auth.password.disabled)" | base64

   Copy the output, then edit the secret:

   kubectl edit secret loft-manager-config -n vcluster-platform

   Replace .data.config with the new value and restart the vCluster Platform pods.

4. Reset the admin password using one of the available methods.

5. Log in with the reset password.

After regaining access, investigate the SSO issue, and fix it before re-locking the admin account.