Offboard an authd user¶

Offboarding a user has an identity provider step and a host step.

Disable provider access¶

Disable or delete the user in the identity provider. You should also revoke active sessions according to the provider’s normal offboarding process.

Disabling provider access alone is sufficient to prevent new authd logins if the force provider access check is enabled.

Otherwise, the user may still log in with a local password while the provider is unreachable. This is the case when the user disables the network, which they can do from the GDM login screen before login.

So delete the local authd account on each affected host as described in the remainder of this guide.

Warning

By default, deleting an authd user does not remove the user’s ~/.ssh/authorized_keys file. If ssh_allowed_suffixes_first_auth allows first-time SSH access and public-key authentication is enabled, a key in that file may still work. Use authctl user delete with the --remove-home flag to remove the home directory, or remove the key separately. See SSH public key authentication for steps to disable public key access for authd users.

Remove the local account¶

If deleting the local account, first review UID and GID conflicts. Deleting a user or group can allow authd to reuse its numeric ID, which may expose files left behind under that ID.

If you only need to prevent login, lock the account instead of deleting it, to preserve its UID and GID and avoid reusing those IDs.

On each affected host:

If the user is listed explicitly in the broker’s allowed_users setting, remove the entry and restart the broker. See configure allowed users.
End any existing sessions:
```
sudo loginctl terminate-user alice@example.com
```
This logs the user out of all sessions on that host and may discard unsaved work.
Decide whether to keep or remove the home directory and its data.

Delete the local authd record:

sudo authctl user delete alice@example.com

To remove the home directory as well, use --remove-home:

sudo authctl user delete --remove-home alice@example.com

authctl user delete releases the user’s UID. Handle any files that must be kept, removed, or reassigned before deleting the record. The command does not remove files outside the home directory. See the authctl reference for the command warning and options.

You can verify that the local record has been removed with:

getent passwd alice@example.com

Note

Deleting the local record does not delete the identity provider account. The provider step must be completed to prevent the user account from being created again on a later login.