Realms
Realms define a Nexus Repository user's authentication source. To manage realms, the user requires the nx-settings privilege. Manage realms under the Settings, Security view.
Note
In Nexus Repository Cloud, Sonatype manages Realms. The Realms configuration is not accessible to Cloud users.
Nexus Repository requires multiple security realms for identifying users. Do not remove all realms from the Active section as this prevents access to Nexus Repository for all users, including administrators.
Activate a security realm by adding it to the Active list in the right-hand column.
Prioritize a realm by moving it higher or lower on the list using the up and down arrows available next to each active realm.
The order in which you have your active realms determines what authentication realm is given priority for granting a user access in the event of a name clash between authentication realms.
You must select Save to preserve changes.
Available Realms
The table below provides details about each available security realm in the Nexus Repository.
Note
Sonatype pre-configures realms for SaaS deployments. Users need not configure realms in Sonatype Cloud.
Realms | Details | On-Prem Availability | Cloud Availability | ||
|---|---|---|---|---|---|
Ansible Galaxy Bearer Token Realm
| This realm is required for validating the Ansible collections. See Ansible documentatation. |
|
| ||
Conan Bearer Token Realm
| This realm is required for uploading to Conan repositories and produces tokens in response to the |
|
| ||
Crowd Realm
| This realm identifies external configuration in an Atlassian Crowd system. |
|
| ||
Default Role Realm
| This realm appends a specific role to use by default for all users once they are authenticated. See Default Role. |
|
| ||
Docker Bearer Token Realm
| This realm is required to access Docker repositories through a Docker client or other container image manager. It is also required to allow anonymous pull access to Docker repositories. |
|
| ||
HuggingFace Bearer Token Realm
| Starting with 3.95, Hugging Face bearer token realm can be used for authentication |
|
| ||
LDAP Realm
| This realm identifies external storage in an LDAP identity provider. See LDAP |
|
| ||
Local Authenticating Realm
| This realm is required to use the built in user management. They allow Nexus Repository to manage authentication without an external identity provider. Keep the Local Authenticating realm at the top of the active list. In the event of system recovery, restoration is difficult when this realm is lower in order or removed. |
|
| ||
npm Bearer Token Realm
| This realm permits users with previously generated bearer tokens to publish npm packages. It also allows users to establish the authentication to a repository with the See npm Security |
|
| ||
NuGet API-Key Realm
| This realm is required for deployments to NuGet repositories. |
|
| ||
OAuth2 Realm
| Authenticates users via OAuth2 JWT tokens from a configured OpenID Connect provider, syncing group claims as roles. |
|
| ||
OCI Bearer Token Realm
| This realm is necessary for configuring OCI authentication. See OCI Repositories. |
|
| ||
Pub Bearer Token Realm
| Validates Dart or Flutter tokens for Pub package operations |
|
| ||
Rut Auth Realm
| This realm allows the use of any external security system that passes the user details through HTTP headers for requests to Nexus Repository. |
|
| ||
SAML Realm
| This realm uses an external Identity Provider (IdP) to handle authentication. See SAML |
|
| ||
Terraform Realm
| This realm validates base64-encoded or encrypted tokens embedded in Terraform URLs. |
|
| ||
| This realm is to enable user tokens as a method for authentication that would normally require passing your username and password in plain text. |
|
|
