> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Machine identity auth templates

> Learn how to use auth templates to standardize authentication configurations for machine identities.

## Concept

Machine Identity Auth Templates allow you to create reusable authentication configurations that can be applied across multiple machine identities. This feature helps standardize authentication setups, reduces configuration drift, and simplifies identity management at scale.

Instead of manually configuring authentication settings for each identity, you can create templates with predefined authentication parameters and apply them to multiple identities. This ensures consistency and reduces the likelihood of configuration errors.

Key Benefits:

* **Standardization**: Ensure consistent authentication configurations across identities
* **Efficiency**: Reduce time spent configuring individual identities
* **Governance**: Centrally manage and update authentication parameters
* **Scalability**: Easily apply proven configurations to new identities

## Managing auth templates

Auth templates are managed in **Access Control** > **Machine Identities**, under **Machine Identity Auth Templates**.

<img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/identities/auth-templates/templates-section.png" alt="Identity Auth Templates Section" />

<Warning>
  Editing a template propagates its authentication settings to every identity linked to it. Treat permission to edit templates as equivalent to permission to manage authentication for all identities that use them, and grant it accordingly.
</Warning>

### Creating a template

<Steps>
  <Step title="Navigate to Auth Templates">
    In your organization, go to **Access Control** > **Machine Identities** and scroll down to **Machine Identity Auth Templates**.
  </Step>

  <Step title="Create a new template">
    Select **Create Template** to open the template creation modal.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/identities/auth-templates/create-template-button.png" alt="Create Template Button" />

    Select the authentication method you want to create a template for (currently supports LDAP Auth, Kubernetes Auth, and OIDC Auth).
  </Step>

  <Step title="Configure template settings">
    Fill in the template configuration based on your chosen authentication method.

    <Tabs>
      <Tab title="LDAP Auth Template">
        **For LDAP Auth templates**, configure the following fields:

        <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/identities/auth-templates/ldap-template.png" alt="LDAP Auth Template" />

        * **Template Name**: A descriptive name for your template
        * **URL**: The LDAP server to connect to such as `ldap://ldap.your-org.com`, `ldaps://ldap.myorg.com:636` *(for connection over SSL/TLS)*, etc.
        * **Bind DN**: The DN to bind to the LDAP server with.
        * **Bind Pass**: The password to bind to the LDAP server with. For security, this value is never displayed again after saving; when editing a template, leave the field blank to keep the current password.
        * **Search Base / DN**: Base DN under which to perform user search such as `ou=Users,dc=acme,dc=com`.
        * **CA Certificate**: The CA certificate to use when verifying the LDAP server certificate. This field is optional but recommended.

        <Note>
          You can read more about LDAP Auth configuration in the [LDAP Auth documentation](/docs/documentation/platform/identities/ldap-auth/general).
        </Note>
      </Tab>

      <Tab title="Kubernetes Auth Template">
        **For Kubernetes Auth templates**, configure the following fields:

        * **Template Name**: A descriptive name for your template
        * **Gateway**: An optional [gateway](/docs/documentation/platform/gateways/overview) or gateway pool used to reach the Kubernetes API server.
        * **Review Mode**: How service account tokens are reviewed. Select **Gateway as Reviewer** to have a gateway deployed in the cluster review tokens with its own service account, or **Manual Token Reviewer JWT (API)** to call the Kubernetes TokenReview API directly.
        * **Kubernetes Host / Base Kubernetes API URL**: The host string, host:port pair, or URL to the base of the Kubernetes API server. Required when the review mode is set to API.
        * **Token Reviewer JWT**: An optional long-lived service account token used to call the TokenReview API. If omitted, the authenticating client's own token is used, which requires the client's service account to have the `system:auth-delegator` ClusterRole binding. For security, this value is never displayed again after saving; when editing a template, leave the field blank to keep the current token.
        * **Allowed Audience**: An optional audience claim that service account tokens must have to authenticate with Infisical.
        * **Verify TLS Certificate** and **CA Certificate**: Whether and how to validate the Kubernetes API server's TLS certificate.

        Allowed namespaces, allowed service account names, and access token settings are not part of the template. They are configured per identity, since they define which workloads may authenticate as each specific identity.

        <Note>
          You can read more about Kubernetes Auth configuration in the [Kubernetes Auth documentation](/docs/documentation/platform/identities/kubernetes-auth).
        </Note>
      </Tab>

      <Tab title="OIDC Auth Template">
        **For OIDC Auth templates**, configure the following fields:

        * **Template Name**: A descriptive name for your template
        * **OIDC Discovery URL**: The URL used to retrieve the OpenID Connect configuration from the identity provider, without the `/.well-known/openid-configuration` suffix. For example, `https://token.actions.githubusercontent.com`.
        * **Issuer**: The unique identifier of the identity provider issuing the JWT, checked against the token's `iss` claim.
        * **Audiences**: An optional comma-separated list of values the token's `aud` claim must match. For providers like GitHub Actions, this is constant across your organization (for example, `https://github.com/your-org`), which makes it a good fit for the template.
        * **CA Certificate**: An optional PEM-encoded CA certificate used for secure communication with the identity provider endpoints, for providers behind a private certificate authority.

        Subject, claims, claim metadata mappings, and access token settings are not part of the template. They are configured per identity, since they define which workloads may authenticate as each specific identity. When attaching an OIDC template, each identity must set a subject or at least one claim binding.

        <Note>
          You can read more about OIDC Auth configuration in the [OIDC Auth documentation](/docs/documentation/platform/identities/oidc-auth/general).
        </Note>
      </Tab>
    </Tabs>
  </Step>
</Steps>

### Using templates

Once created, templates can be applied when configuring authentication methods for machine identities. When adding an auth method to an identity, you'll have the option to select from available templates or configure manually.

<img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/identities/auth-templates/machine-identity-page.png" alt="Attach Template" />

<img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/identities/auth-templates/attach-template-form.png" alt="Attach Template Form" />

### Managing template usage

You can view which identities are using a specific template by selecting **View Usages** in the template's dropdown menu.

<img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/identities/auth-templates/template-usages.png" alt="Template Usages" />

<img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/identities/auth-templates/template-usages-modal.png" alt="Template Usages Modal" />

## FAQ

<AccordionGroup>
  <Accordion title="Can I modify a template after it's been applied to identities?">
    Yes, you can edit existing templates. After editing a template, changes to templates will automatically update identities that are already using them.
  </Accordion>

  <Accordion title="What happens if I delete a template that's in use?">
    If you delete a template that's currently being used by identities, those identities will continue to function with their existing configuration. However, the link to the template will be broken, and you won't be able to use the template for new identities.
  </Accordion>

  <Accordion title="Can I see which identities are using a specific template?">
    Yes, select **View Usages** in the template's dropdown menu to see all identities currently using that template.
  </Accordion>

  <Accordion title="Do templates support all authentication methods?">
    Currently, auth templates support LDAP Auth and Kubernetes Auth. Support for additional authentication methods will be added in future releases.
  </Accordion>
</AccordionGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.