// Module included in the following assemblies:
//
// * authentication/external-auth.adoc

:_mod-docs-content-type: PROCEDURE
[id="external-auth-disabling_{context}"]
= Disabling direct authentication

If necessary, you can disable direct authentication for your cluster and revert back to authenticating with the built-in OpenShift OAuth server.

.Prerequisites

* You have access to the `kubeconfig` file generated by the installation program for the cluster.

.Procedure

. Ensure that you are using the `kubeconfig` file generated by the installation program, or another long-lived method of logging in as a cluster administrator.

. Update the authentication configuration to use the built-in OpenShift OAuth server by running the following command:
+
[source,terminal]
----
$ oc patch authentication.config/cluster --type=merge -p='
spec:
  type: "" <1>
  oidcProviders: null <2>
'
----
<1> Sets `type` to `""` to use the built-in OpenShift OAuth server. A value of `IntegratedOAuth` is also equivalent.
<2> Removes the `oidcProviders` configuration.

. Wait for the cluster to roll out new revisions to all nodes.

.. Check the Kubernetes API server Operator status by running the following command:
+
[source,terminal]
----
$ oc get co kube-apiserver
----
+
.Example output
[source,terminal]
----
NAME             VERSION   AVAILABLE   PROGRESSING   DEGRADED   SINCE   MESSAGE
kube-apiserver   4.19.0    True        True          False      85m     NodeInstallerProgressing: 2 node are at revision 12; 1 node is at revision 14
----
+
The message in the preceding example shows that one node has progressed to the new revision and two nodes have not yet updated. It can take 20 minutes or more to roll out the new revision to all nodes, depending on the size of your cluster.

.. To troubleshoot any issues, you can also check the Cluster Authentication Operator and `kube-apiserver` pod logs for errors.

. If necessary, restore any existing authentication configuration.

.Verification

* Verify that you can successfully log in to the {product-title} web console and {oc-first}.
