Hermes Gateway Security — Authentication & Access Control

This page covers authentication methods and security considerations for Hermes Gateway. For details on ports and connection options, see the Access Guide.

Authentication Methods

Hermes Gateway supports multiple authentication methods, with a roadmap for federated identity and centralised management tool integrations. Currently supported:

Passthrough Authentication (Default)

passthru (or passthrough) forwards authentication credentials directly to the upstream MySQL/MariaDB database, reusing your existing access controls with no additional configuration.

The upstream database must be configured to allow plaintext passwords. See the MySQL documentation for details.

Allowlist via Lua Script

Authenticate users against a CSV file using a Lua script. This method enables flexible integration with external secret stores — for example, mounting a Vault secrets file into your container:

HashiCorp Vault Kubernetes annotations

For a practical walkthrough, see the User Authentication with Lua Script guide.

No Authentication

Setting handler: none disables all authentication. Do not use this in any internet-facing or shared environment. It is intended only for isolated local development.