Authentication

Authentication is how SSOGEN establishes who a person is. These guides cover the identity providers people can sign in with, the sign-in page, second steps such as phone approval and passkeys, password rules, and what happens when someone forgets a password.

Begin with the overview of identity providers, then add the provider your organization uses.

1. Identity providers

   The four kinds of provider (local, LDAP, SAML, OpenID Connect), when to choose each, and the draft-to-active lifecycle.

2. The sign-in page

   How a typed email address reaches the right provider by domain, plus layout, default provider, order and branding.

3. Add a SAML identity provider

   Wizard fields, metadata import, attribute mapping and sign-in domains, with Entra ID and Keycloak steps.

4. Add an OIDC identity provider

   Issuer, client ID and secret, scopes and claim mapping, then Test and Activate, with Entra ID and Keycloak steps.

5. Multi-factor authentication

   Phone approval with number matching, authenticator codes, passkeys, recovery codes and optional email and text codes.

6. Windows desktop sign-in

   Sign people in without a password from a domain-joined Windows computer, with testing and fixes.

7. Password policy

   Presets, minimum length, history, expiry and lockout for people whose password SSOGEN holds.

8. Password reset and recovery

   How people reset a forgotten password themselves, and how an administrator recovers a lost password or second step.

9. Admin Console sign-in

   How administrators sign in, the policy made at setup, and the rules that keep an administrator from being locked out.

10. Security settings

    Every Security page setting with its default and range: attempt limits, lockout, sessions, recovery and retention.

11. Lost or replaced phone

    What an administrator does when a person loses, replaces or wipes the phone they sign in with: revoke the phone, clear a push pause, reset every second

12. One-time code policy

    The settings an administrator controls for 6-digit sign-in codes: which authenticator apps are accepted and the default, where codes sit in a policy, the

13. Passkeys for administrators

    How a sign-in policy allows, requires or turns off passkeys, what a person enrols, what the Admin Console shows about it, and the limits.

14. Set up push approval

    What an administrator turns on so people approve sign-ins by tapping a number in the SSOGEN Authenticator: the policy, the Authenticator settings, how people