docs: clarify that disable-password-auth also applies to owners (#30362)

The `--disable-password-auth` help text says owners can still sign in
with a password "to avoid potential lock out", and a comment in
`coderd/userauth.go` says the same. Neither is true. #6193 removed the
owner bypass on purpose, so the flag blocks password login for everyone.
The recovery advice was also wrong. It named a command that doesn't
exist (`create-admin`), and any admin that `create-admin-user` creates
while the flag is on still can't sign in.

This PR changes docs and comments only:
- Rewrites the flag description to say it applies to owners too and how
to recover access. Regenerated the CLI and config reference docs and the
golden files.
- Fixes the misleading comment in `coderd/userauth.go`.
- Adds the same warning and recovery steps to
`docs/admin/users/password-auth.md`.

> [!NOTE]
> Generated by Coder Agents on behalf of @jdomeracki-coder.

cli/testdata/coder_server_--help.golden

@@ -574,11 +574,10 @@ NETWORKING / HTTP OPTIONS:
       --disable-password-auth bool, $CODER_DISABLE_PASSWORD_AUTH
           Disable password authentication. This is recommended for security
           purposes in production deployments that rely on an identity provider.
-          Any user with the owner role will be able to sign in with their
-          password regardless of this setting to avoid potential lock out. If
-          you are locked out of your account, you can use the `coder server
-          create-admin` command to create a new admin user directly in the
-          database.
+          This applies to all users, including owners. Ensure an owner can sign
+          in through your identity provider before enabling this. To recover
+          access, unset this option, restart the server, and use `coder server
+          create-admin-user` if needed.
 
       --disable-session-expiry-refresh bool, $CODER_DISABLE_SESSION_EXPIRY_REFRESH
           Disable automatic session expiry bumping due to activity. This forces

cli/testdata/server-config.yaml.golden

@@ -46,11 +46,10 @@ networking:
     # (default: <unset>, type: bool)
     disableSessionExpiryRefresh: false
     # Disable password authentication. This is recommended for security purposes in
-    # production deployments that rely on an identity provider. Any user with the
-    # owner role will be able to sign in with their password regardless of this
-    # setting to avoid potential lock out. If you are locked out of your account, you
-    # can use the `coder server create-admin` command to create a new admin user
-    # directly in the database.
+    # production deployments that rely on an identity provider. This applies to all
+    # users, including owners. Ensure an owner can sign in through your identity
+    # provider before enabling this. To recover access, unset this option, restart the
+    # server, and use `coder server create-admin-user` if needed.
     # (default: <unset>, type: bool)
     disablePasswordAuth: false
     # The interval in which coderd should be checking the status of workspace proxies.

coderd/userauth.go

@@ -595,8 +595,7 @@ func (api *API) loginRequest(ctx context.Context, rw http.ResponseWriter, req co
 		return user, rbac.Subject{}, false
 	}
 
-	// If password authentication is disabled and the user does not have the
-	// owner role, block the request.
+	// Password authentication is disabled for all users, including owners.
 	if api.DeploymentValues.DisablePasswordAuth {
 		httpapi.Write(ctx, rw, http.StatusForbidden, codersdk.Response{
 			Message: "Password authentication is disabled.",

codersdk/deployment.go

@@ -3888,7 +3888,7 @@ communicating directly.`,
 		},
 		{
 			Name:        "Disable Password Authentication",
-			Description: "Disable password authentication. This is recommended for security purposes in production deployments that rely on an identity provider. Any user with the owner role will be able to sign in with their password regardless of this setting to avoid potential lock out. If you are locked out of your account, you can use the `coder server create-admin` command to create a new admin user directly in the database.",
+			Description: "Disable password authentication. This is recommended for security purposes in production deployments that rely on an identity provider. This applies to all users, including owners. Ensure an owner can sign in through your identity provider before enabling this. To recover access, unset this option, restart the server, and use `coder server create-admin-user` if needed.",
 			Flag:        "disable-password-auth",
 			Env:         "CODER_DISABLE_PASSWORD_AUTH",
 

docs/admin/setup/configuration-reference.md

@@ -1346,8 +1346,9 @@ Format matches the CSP directive format, e.g. --additional-csp-policy="script-sr
 
 Disable password authentication.
 This is recommended for security purposes in production deployments that rely on an identity provider.
-Any user with the owner role will be able to sign in with their password regardless of this setting to avoid potential lock out.
-If you are locked out of your account, you can use the `coder server create-admin` command to create a new admin user directly in the database.
+This applies to all users, including owners.
+Ensure an owner can sign in through your identity provider before enabling this.
+To recover access, unset this option, restart the server, and use `coder server create-admin-user` if needed.
 
 - Type: `bool`
 - Environment variable: `CODER_DISABLE_PASSWORD_AUTH`

docs/admin/users/password-auth.md

@@ -11,11 +11,17 @@ To disable password authentication, use the
 [`CODER_DISABLE_PASSWORD_AUTH`](../../reference/cli/server/index.md#--disable-password-auth)
 flag on the control plane.
 
+This blocks password sign-in and password resets for all users, including
+owners. Before you enable it, make sure at least one owner can sign in through
+your identity provider.
+
 ## Restore the `Owner` user
 
 If you remove the admin user account (or forget the password), you can run the
 [`coder server create-admin-user`](../../reference/cli/server/create-admin-user.md)command
-on your server.
+on your server. If password authentication is disabled, unset
+`CODER_DISABLE_PASSWORD_AUTH` and restart the server first, or the new admin
+will not be able to sign in.
 
 > [!IMPORTANT]
 > You must run this command on the same machine running the control plane.

docs/reference/cli/server/index.md

@@ -1307,7 +1307,7 @@ Disable automatic session expiry bumping due to activity. This forces all sessio
 | Environment | <code>$CODER_DISABLE_PASSWORD_AUTH</code>        |
 | YAML        | <code>networking.http.disablePasswordAuth</code> |
 
-Disable password authentication. This is recommended for security purposes in production deployments that rely on an identity provider. Any user with the owner role will be able to sign in with their password regardless of this setting to avoid potential lock out. If you are locked out of your account, you can use the `coder server create-admin` command to create a new admin user directly in the database.
+Disable password authentication. This is recommended for security purposes in production deployments that rely on an identity provider. This applies to all users, including owners. Ensure an owner can sign in through your identity provider before enabling this. To recover access, unset this option, restart the server, and use `coder server create-admin-user` if needed.
 
 ### -c, --config
 

enterprise/cli/testdata/coder_server_--help.golden

@@ -575,11 +575,10 @@ NETWORKING / HTTP OPTIONS:
       --disable-password-auth bool, $CODER_DISABLE_PASSWORD_AUTH
           Disable password authentication. This is recommended for security
           purposes in production deployments that rely on an identity provider.
-          Any user with the owner role will be able to sign in with their
-          password regardless of this setting to avoid potential lock out. If
-          you are locked out of your account, you can use the `coder server
-          create-admin` command to create a new admin user directly in the
-          database.
+          This applies to all users, including owners. Ensure an owner can sign
+          in through your identity provider before enabling this. To recover
+          access, unset this option, restart the server, and use `coder server
+          create-admin-user` if needed.
 
       --disable-session-expiry-refresh bool, $CODER_DISABLE_SESSION_EXPIRY_REFRESH
           Disable automatic session expiry bumping due to activity. This forces