Juju Authentication: Methods, Credentials, and Security (2026)

Authentication overview

Juju's authentication system is designed to secure access to Juju controllers and the models they manage. A Juju controller acts as the central management plane for deploying and operating applications. Authentication ensures that only authorized users and systems can interact with these controllers, create and manage models, and deploy or modify applications. The system supports both human users interacting via the Juju command-line interface (CLI) and automated systems requiring programmatic access to the Juju API.

The core of Juju's authentication relies on a robust identity management system, primarily using API keys for direct programmatic access and integrating with OpenID Connect (OIDC) for federated identity. This allows Juju to operate securely in diverse environments, from local development setups to large-scale multi-cloud deployments and Kubernetes clusters. Access control within Juju is further managed through Role-Based Access Control (RBAC), where permissions are granted based on roles assigned to authenticated users or entities. This layered approach ensures granular control over operations within Juju, aligning with the principle of least privilege.

Understanding Juju's authentication mechanisms is crucial for secure operation. This includes knowing how to generate and manage API keys, configure OIDC integration, and apply appropriate RBAC policies to safeguard your deployed applications and infrastructure. The Juju documentation provides comprehensive guides on setting up and managing these security features for Juju controllers and models.

Supported authentication methods

Juju supports several authentication methods to accommodate different operational needs and security requirements. The primary methods include API keys and integration with OpenID Connect (OIDC).

API Keys

API keys are the fundamental method for authenticating to a Juju controller, especially for programmatic access and CLI interactions. When a user logs in via the Juju CLI, an API key is generated and stored locally. This key is then used for subsequent commands, authenticating the user's requests to the Juju controller. API keys provide a direct and efficient way to verify identity for automated scripts and continuous integration/continuous deployment (CI/CD) pipelines. Juju's API keys are specific to a controller and can be managed (e.g., revoked) through the Juju CLI, offering control over access.

OpenID Connect (OIDC)

Juju integrates with OpenID Connect (OIDC) for federated identity management. OIDC is an identity layer built on top of the OAuth 2.0 protocol, enabling clients to verify the identity of the end-user based on the authentication performed by an authorization server, as well as to obtain basic profile information about the end-user. This integration allows Juju users to authenticate using existing identity providers (IdPs) such as Google, Azure Active Directory, or Okta, centralizing user management and leveraging established enterprise identity systems. When OIDC is configured, the Juju controller delegates user authentication to the specified IdP, receiving an identity token that verifies the user's identity. This enhances security by reducing the need for separate Juju-specific credentials and enables single sign-on (SSO) experiences.

The OpenID Foundation maintains the official specifications and best practices for OpenID Connect, detailing its architecture and security considerations. For more information, refer to the OpenID Connect documentation.

Table of Authentication Methods

Getting your credentials

Obtaining and managing credentials in Juju primarily involves using the Juju CLI to interact with your Juju controller. The process differs slightly depending on whether you are using API keys directly or leveraging OIDC for authentication.

For API Keys

1. Bootstrap a Controller: If you don't have a Juju controller, you'll first need to bootstrap one. This command typically authenticates you to the underlying cloud provider and then establishes the Juju controller. For example, juju bootstrap aws will create a controller on AWS. Upon successful bootstrapping, your initial API key is automatically configured for your local Juju client.
2. Login to an Existing Controller: If you need to connect to an existing Juju controller that you haven't previously accessed from your current machine, use the juju login command. You will be prompted for the controller's address and your password. Upon successful login, Juju generates and stores an API key locally, linking your client to that controller.
3. Generate Additional API Keys: For automated systems or specific users, you can generate new API keys using juju create-user to create a new user and then juju grant to assign roles. The API key for a user can be obtained or reset.
4. Manage Stored Keys: Juju stores API keys in a configuration file (typically ~/.local/share/juju/accounts.yaml on Linux). You can view connected controllers and their associated accounts using juju controllers.

For OpenID Connect (OIDC)

To use OIDC, the Juju controller must first be configured to integrate with your chosen Identity Provider (IdP). This configuration is typically performed by a Juju administrator.

1. Controller Configuration: An administrator configures the Juju controller with the OIDC provider's details, including the issuer URL, client ID, and client secret. This involves using Juju model configuration commands.
2. User Login: Once configured, users can log in using juju login --oidc. This command will typically open a web browser, redirecting you to your IdP's login page. After successful authentication with your IdP, you will be redirected back to Juju, and an identity token will be exchanged for a Juju API key, which is then stored locally.
3. Role Mapping: The Juju administrator will also need to map roles or groups from the OIDC provider to Juju's internal Role-Based Access Control (RBAC) system. This ensures that users authenticated via OIDC are granted appropriate permissions within Juju models.

For detailed instructions on configuring OIDC with Juju, refer to the Juju OIDC authentication guide.

Authenticated request example

Authenticated requests to a Juju controller are typically handled by the Juju CLI directly. When you execute a juju command, the CLI automatically uses the locally stored API key associated with the currently active controller and user. You do not explicitly pass the API key in each command.

Example using Juju CLI

After you have successfully logged in to a Juju controller (either via juju login or by bootstrapping a controller), your subsequent commands are authenticated automatically:

# Ensure you are logged into a controller
# If not, run: juju login <controller-name>

# List all controllers you have access to
juju controllers

# Switch to a specific model (if not already active)
juju switch my-controller:my-model

# Deploy an application to the current model
juju deploy postgresql

# Check the status of deployed applications
juju status

In this sequence, each juju command sends an authenticated request to the Juju controller using the stored API key. The Juju CLI manages the lifecycle of this authentication token, refreshing it as needed and ensuring that your interactions with the controller are authorized.

Programmatic Access (Conceptual)

For direct programmatic access to the Juju API (e.g., when developing custom tools or integrations), you would typically use a Juju SDK or client library that handles the authentication details, similar to how the CLI operates. These libraries abstract away the direct handling of API keys or OIDC tokens, providing methods to interact with the controller after an initial authentication step. While Juju provides a model API overview, direct HTTP requests requiring manual token management are less common for typical Juju operations.

Security best practices

Securing your Juju environment is critical for protecting your applications and infrastructure. Adhering to security best practices for authentication and access control minimizes potential vulnerabilities.

1. Principle of Least Privilege: Always grant users and automated systems only the minimum necessary permissions to perform their tasks. Juju's RBAC system allows for fine-grained control over permissions at the controller and model levels. Regularly review and adjust permissions as roles and responsibilities change.
2. Secure API Key Management: Treat Juju API keys as sensitive credentials. Never hardcode them directly into scripts or commit them to version control systems. Instead, use environment variables, secret management tools, or secure configuration files. Rotate API keys regularly, especially for automated systems. When a user leaves an organization or a system is decommissioned, revoke their API keys immediately using the Juju CLI.
3. Leverage OIDC for Centralized Identity: For organizations with existing identity providers, integrate Juju with OpenID Connect (OIDC). This centralizes user authentication, allows for multi-factor authentication (MFA) enforcement through your IdP, and simplifies user lifecycle management. OIDC reduces the overhead of managing separate Juju credentials and enhances overall security posture. The Cloud Native Computing Foundation (CNCF) provides resources on identity management in cloud-native environments, including OIDC best practices, which can be found in their Cloud Security documentation.
4. Regular Security Audits: Periodically audit your Juju controller configurations, user accounts, and assigned roles. Look for dormant accounts, excessive permissions, or unneeded API keys. Ensure that logging and monitoring are enabled on your Juju controller to detect and respond to suspicious activity.
5. Keep Juju Updated: Always run the latest stable versions of the Juju CLI and controller. Updates often include security patches and improvements that address newly discovered vulnerabilities.
6. Network Security: Ensure that your Juju controller is deployed in a secure network environment. Restrict network access to the controller's API endpoint to only trusted IP ranges or VPNs. Utilize firewalls and security groups to control inbound and outbound traffic.
7. Backup and Recovery: Implement regular backup procedures for your Juju controller's data, including authentication configurations and model states. This ensures that you can recover quickly in case of data loss or a security incident.