goauthentik · dominic-r · Aug 28, 2026 · Aug 27, 2026 · Aug 28, 2026 · Aug 28, 2026
@@ -1,22 +1,22 @@
 ---
-title: Integrate with Nutanix AHV
-sidebar_label: Nutanix AHV
+title: Integrate with Nutanix Prism Central
+sidebar_label: Nutanix Prism Central
 support_level: community
 ---
 
 import SAMLProvider20265Warning from "../../\_saml-provider-2026-5-warning.mdx";
 
-## What is Nutanix AHV?
+## What is Nutanix Prism Central?
 
-> Nutanix AHV is the native hypervisor of the Nutanix Cloud Platform, providing enterprise virtualization for compute workloads. AHV clusters are managed through Prism Central, which supports single sign-on with SAML 2.0 identity providers.
+> Nutanix Prism Central, also known as Nutanix PC, is a centralized software virtual appliance that allows you to manage multiple physical or cloud-based clusters from one unified dashboard. It supports single sign-on with SAML 2.0 identity providers.
 >
-> -- https://www.nutanix.com/products/ahv
+> -- https://www.nutanix.com/products/prism
 
 ## Preparation
 
 The following placeholders are used in this guide:
 
-- `prismcentral.company` is the FQDN of the Prism Central instance that manages the Nutanix AHV cluster.
+- `prismcentral.company` is the FQDN of the Prism Central installation.
 - `authentik.company` is the FQDN of the authentik installation.
 
 :::info
@@ -27,7 +27,7 @@ This guide follows the authorization policy workflow available in Prism Central
 
 ## authentik configuration
 
-To support the integration of Nutanix AHV with authentik, you need to create two property mappings and an application/provider pair in authentik. Prism Central identifies users by the username and email attributes in the SAML assertion, and uses the NameID attribute for role mapping.
+To support the integration of Prism Central with authentik, you need to create two property mappings and an application/provider pair in authentik. Prism Central identifies users by the username and email attributes in the SAML assertion, and uses the NameID attribute for role mapping.
 
 ### Create property mappings
 
@@ -79,9 +79,7 @@ To support the integration of Nutanix AHV with authentik, you need to create two
 1. In the authentik Admin interface, navigate to **Applications** > **Providers** and click on the name of the provider that you created in the previous section.
 2. Under **Related objects** > **Metadata**, click **Download**. This metadata file is required in the next section.
 
-## Nutanix AHV configuration
-
-Authentication for Nutanix AHV clusters is configured in Prism Central.
+## Nutanix Prism Central configuration
 
 ### Add the identity provider
 
@@ -111,7 +109,7 @@ On earlier Prism Central versions, select or create a role, then use **Actions**
 
 ## Configuration verification
 
-To confirm that authentik is properly configured with Nutanix AHV, open Prism Central and select the authentik configuration on the login screen. Complete the authentik authentication flow and confirm that Prism Central opens with the expected role.
+To confirm that authentik is properly configured with Prism Central, open Prism Central and select the authentik configuration on the login screen. Complete the authentik authentication flow and confirm that Prism Central opens with the expected role.
 
 ## Resources
 

@@ -0,0 +1,104 @@
+---
+title: Integrate with Nutanix Prism Element
+sidebar_label: Nutanix Prism Element
+support_level: community
+---
+
+## What is Nutanix Prism Element?
+
+> Localized cluster manager responsible for local cluster management and operations. Every Nutanix Cluster has Prism Element built-in.
+>
+> -- https://www.nutanixbible.com/3a-book-of-prism-architecture.html
+
+## Preparation
+
+The following placeholders are used in this guide:
+
+- `ldap.company` is the FQDN of the authentik LDAP outpost.
+
+Prism Element authenticates users against LDAP. Prism Element must be able to reach the authentik LDAP outpost on port `636` and trust the certificate that the outpost presents for `ldap.company`.
+
+:::info
+This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application.
+:::
+
+## authentik configuration
+
+To support the integration of Prism Element with authentik, you need to create groups for Prism Element access and configure an LDAP provider and outpost.
+
+### Create access groups
+
+Create groups that Prism Element maps to roles. Prism Element grants a role to a group rather than to individual users, so create one group for each role that you want to assign.
+
+1. Log in to authentik as an administrator and open the authentik Admin interface.
+2. Navigate to **Directory** > **Groups** and click **Create**.
+3. Set **Name** to `npe-users` and click **Create**.
+4. Open the group, select the **Users** tab, and add the users who should have non-administrative access to Prism Element.
+5. Repeat these steps with the name `npe-admins`, and add the users who should have Prism Element administrator privileges.
+
+### Create the LDAP resources
+
+Follow the [LDAP provider setup](/docs/add-secure-apps/providers/ldap/create-ldap-provider/) to create or reuse an LDAP application and provider, create a service account with LDAP search permissions, and create an LDAP outpost.
+
+Use the following Prism Element settings while completing the LDAP provider setup:
+
+- Use `npe-ldap` as the service account username. Note its password and full DN for the Prism Element configuration.
+- Note the LDAP provider's **Base DN** as `<base_dn>`.
+- On the LDAP provider, set **Certificate** to the certificate that Prism Element should trust for `ldap.company`.
+- Set **TLS Server Name** to `ldap.company`.
+- Select the Prism Element LDAP application on the outpost and expose the outpost as `ldap.company`.
+
+If you configure application bindings, ensure that `npe-ldap`, `npe-users`, and `npe-admins` have access to the LDAP application.
+
+## Nutanix Prism Element configuration
+
+### Configure LDAP authentication
+
+:::info Local accounts stay enabled
+Selecting **Directory Service** adds LDAP as an authentication type. Prism Element keeps accepting local accounts.
+:::
+
+1. Log in to Prism Element as a user with administrator privileges.
+2. Click the gear icon in the top right and navigate to **Users and Roles** > **Authentication**.
+3. On the **Directory List** tab, click **Add**.
+4. Configure the following settings. Replace `<base_dn>` with the **Base DN** of the authentik LDAP provider.
+    - **Directory Type**: `OpenLDAP`
+    - **Name**: `authentik`
+    - **Domain**: the base DN in dotted form. For example, if `<base_dn>` is `dc=ldap,dc=goauthentik,dc=io`, the domain is `ldap.goauthentik.io`.
+    - **Directory URL**: `ldaps://ldap.company:636`
+    - **User Object Class**: `user`
+    - **User Search Base**: `ou=users,<base_dn>`
+    - **Username Attribute**: `cn`
+    - **Group Object Class**: `group`
+    - **Group Search Base**: `ou=groups,<base_dn>`
+    - **Group Member Attribute**: `member`
+    - **Group Member Attribute Value**: `dn`
+    - **Service Account**: `cn=npe-ldap,ou=users,<base_dn>`
+    - **Service Account Password**: the password for the `npe-ldap` service account
+5. Click **Save**.
+6. Open the **Authentication Types** tab, select **Directory Service**, and click **Save**.
+
+Users append the **Domain** value to their username when they log in. With a domain of `ldap.goauthentik.io`, the user `akadmin` logs in as `akadmin@ldap.goauthentik.io`.
+
+### Create the role mappings
+
+Prism Element does not grant permissions to directory users automatically. After you save the directory, map each authentik group to the role that its members should receive.
+
+1. Click the gear icon in the top right and navigate to **Users and Roles** > **Role Mapping**.
+2. Click **New Mapping**.
+3. Select the directory that you created from the **Directory or Provider** list.
+4. Select `Group` in the **Type** list.
+5. Enter the group name exactly as it appears in authentik, for example `npe-admins`.
+6. Select the role to grant, then click **Save**.
+7. Repeat these steps for `npe-users`.
+
+## Configuration verification
+
+To confirm that authentik is properly configured with Prism Element, open Prism Element and log in with an authentik username and the **Domain** value appended, along with the authentik password. A user in `npe-users` should reach Prism Element with the role that you mapped, and a user in `npe-admins` should have administrator privileges.
+
+You can also test the directory without logging out. On the **Directory List** tab, click **Test**, then enter the same username and password. Prism Element reports **Authentication test successful** when the directory is reachable and the credentials are accepted.
+
+## Resources
+
+- [Nutanix Security Guide - Configuring OpenLDAP Authentication](https://portal.nutanix.com/page/documents/details?targetId=Nutanix-Security-Guide-v7_6:wc-openldap-authentication-wc-t.html)
+- [Nutanix Security Guide - Role permissions](https://portal.nutanix.com/page/documents/details?targetId=Nutanix-Security-Guide-v7_6:wc-security-role-permissions-wc-t.html)
@@ -30,3 +30,6 @@
 /networking/cloudflare-access                                      /security/cloudflare-access 301!
 
 /platforms/microsoft                                               /platforms/microsoft-saml 301!
+
+/hypervisors-orchestrators/nutanix-ahv                             /hypervisors-orchestrators/nutanix-pc 301!
+/hypervisors-orchestrators/nutanix-ahv/                            /hypervisors-orchestrators/nutanix-pc/ 301!