Choose the login methods#

Open Settings → Authentication. The page manages password-login behavior, identity-related settings, OAuth providers and LDAP configuration. File-managed authentication sections cannot be edited here.

Keep a working administrator session while validating a replacement login method. Do not disable the current method until the external sign-in flow and administrative role mapping have been tested with a separate session.

The same page has separate MFA and Passkey Login switches. Enable the relevant method, save, then have a test user enroll it in Account Settings → Security and verify sign-in. The installation-level switch and a user’s actual enrolled factor are distinct.

Authentication settings separate password, MFA and passkey availability from OAuth providers and LDAP configuration.
Authentication settings separate password, MFA and passkey availability from OAuth providers and LDAP configuration. View full size ↗

Add an OAuth provider#

  1. Create a provider with the name and provider configuration appropriate to your identity service.
  2. Enter the client identifier and secret and configure the required provider endpoints/scopes presented by the form.
  3. Register the exact callback URL for your Orkiva public origin and subpath with the identity provider.
  4. Save and test the provider from the login screen in another session.
  5. Check the resulting identity and group-to-role assignments before enabling broad access.

A successful redirect to the provider is only the first half of the test. The callback must return to the same configured installation and produce the intended Orkiva identity.

The OAuth provider form groups client settings, discovery or explicit endpoints, identity claims and allowed groups.
The OAuth provider form groups client settings, discovery or explicit endpoints, identity claims and allowed groups. View full size ↗

Configure LDAP#

FieldWhat to provide
Server URL / StartTLSThe reviewed LDAP endpoint and transport choice. StartTLS applies to an ldap:// connection when enabled.
Bind DN / passwordThe directory account used for the configured search.
User base DN / filterThe search base and filter that find the intended login identities.
Username / display-name attributeThe directory attributes used to identify and display a user.
Group base DN / filter / group-name attributeThe search settings that supply group membership for RBAC mapping.
  1. Enter the directory settings and save. Preserve the existing bind secret when using the form’s retain-current-secret behavior.
  2. Test a normal user and an administrator mapping.
  3. Verify both successful login and denial for a directory identity outside the allowed scope.

Diagnose external sign-in#

For OAuth, check the provider response, callback URL, client configuration and trusted public origin. For LDAP, check server reachability, TLS trust, bind credentials, search bases and filter results. A valid directory password does not guarantee that the configured user search or group mapping returns the correct identity.