- 5 minutes to read

Migrate Authentication Method in Nodinite v7

Each Nodinite v7 Environment uses exactly one authentication mode, chosen in the Portal Step 2: Auth. Use this authentication migration guide to move an existing Environment between:

  • Windows Authentication / Kerberos OpenID Connect / OAuth 2.0
  • OpenID Connect / OAuth 2.0 Windows Authentication / Kerberos

The two modes grant access differently. Windows Authentication grants it to Active Directory Users and Windows AD Groups; OpenID Connect grants it through Claims combined into Policies. Both end in Roles. You can't mix the modes, so access must be realigned after the switch.

Understand the Migration Model

You don't change authentication in place on running binaries. You uninstall the Core Services, change the Environment in the Portal, and reinstall with the normal update flow. The Configuration Database, the Log Databases, and the settings files stay, so the reinstall reuses the Environment state.

flowchart TB Prereq["fa:fa-list-check Check target prerequisites"] --> Uninstall["fa:fa-trash Uninstall Core Services
keep databases and settings"] Uninstall --> Portal["fa:fa-gear Change Auth mode in the Portal
Step 2: Auth"] Portal --> Download["fa:fa-download Download the new package"] Download --> Update["fa:fa-terminal Run the update with the CLI"] Update --> Target{"Target mode?"} Target -->|"OpenID Connect"| Oidc["fa:fa-key Map Claims to Policies to Roles
replace the Email Alarm Plugin"] Target -->|"Windows Authentication"| Win["fab:fa-windows Assign AD users and groups to Roles"] Oidc --> Verify["fa:fa-circle-check Verify sign-in, access, and alarms"] Win --> Verify style Uninstall fill:#E47528 style Portal fill:#2678BD style Download fill:#2678BD style Update fill:#E47528 style Oidc fill:#9E59BB style Win fill:#9E59BB style Verify fill:#93d16d

Orange steps change the server, blue steps happen in the Portal, purple steps realign access for the target mode, and green is the final check. See Uninstall Nodinite v7, Step 2: Auth, Updating Nodinite v7, Claims, Policies, Roles, Windows AD Groups, and E-mail with options.

What Changes Between the Modes

Aspect Windows Authentication / Kerberos OpenID Connect / OAuth 2.0
Sign-in Kerberos (NTLM fallback) against Active Directory Identity provider, such as Microsoft Entra ID, including MFA
Access granted to Users and Windows AD Groups in Roles Claims combined in Policies, assigned to Roles
Portal values Administrator account, domain defaults Discovery URL, app registrations, Nodinite Claims; see Install Nodinite v7 - OpenID
TLS Recommended Required; see Step 4: Servers → Core host Configuration
Email Alarm Plugin ✅ Supported ❌ Not supported; use E-mail with options

Prerequisites Before Any Migration

Validate the prerequisites of the target mode before you uninstall anything:

Standard Migration Workflow

Step 1: Uninstall Without Removing Data

Run the uninstall command of Nodinite.Installer.Cli.exe from the package of the currently installed version, before you change the authentication settings.

This removes the Core Services and keeps the Environment state, so you can reinstall with the new authentication method.

Step 2: Update the Environment in the Portal and Download the New Package

In the Nodinite Portal, open the existing Environment and change the Auth Mode in Step 2: Auth to the target model.

  • Fill in the fields of the target mode.
  • Save the Environment changes.
  • Download the newly generated ZIP package in Step 6: Review and Download.

Step 3: Reinstall with the Standard Update Instructions

Run the CLI from the newly downloaded package, as described in Updating Nodinite v7. Because the settings and databases already exist, this is a standard update-style installation. When you move to OpenID Connect, the CLI asks for the client secrets; see Client Secrets.

Path-Specific Notes

Windows/Kerberos to OpenID Connect

After switching to OpenID Connect, authorization no longer depends on Windows group resolution. Re-map access with Claims, Policies, and the groups or app roles in your identity provider.

Email Alarm Plugin Impact

  • The Email Alarm Plugin can no longer be used: it depends on user e-mail data resolved from Active Directory through Roles and Users, which don't apply after moving to OpenID Connect.
  • Before the switch, remove it from every Monitor View that uses it, and replace it with E-mail with options, where you set the recipient addresses directly. Otherwise alarms fail silently.

We recommend E-mail with options as your standard Alarm Plugin in both modes, because it provides richer capabilities.

OpenID Connect to Windows/Kerberos

After switching back to Windows/Kerberos, revalidate domain-based authorization mappings.

Reconcile Roles and Authorization After Migration

Regardless of migration direction, realign authorization for the new model.

  • Review and update Role assignments.
  • If using OpenID Connect, validate the Policies and Claims mapping.
  • If using Windows/Kerberos, validate users and groups from Active Directory.

In many Environments, only the initial administrator can access the system immediately after migration until Role assignments are updated.

Optional Identity Cleanup After Migration

After a successful migration, identity administrators often remove obsolete configuration from the previous model, such as old groups or service accounts, unused Claims or Policies, and app registrations no longer in use. This cleanup is organization-specific, so this guide doesn't prescribe one universal procedure; Uninstall Nodinite v7 lists the typical items.

Final Verification and Operational Review

After migration and access remapping:

  • Verify administrator and non-administrator sign-in paths.
  • Verify role-based access for expected user groups.
  • Verify alarm behavior if e-mail notifications are in use.
  • Review Post-installation and apply relevant hardening, backup, and maintenance practices.

Next Steps