> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/administration-guide/security.md).

# Secure sign-in and credentials

Route to the right authentication, MFA, passwordless, password, recovery or credential-rotation task, and know which object you are actually editing.

## What this is, and when you need it

This section covers how a person proves who they are, what a password must look like, how a lost credential is recovered, how a help-desk operator verifies a caller, and how infrastructure secrets are rotated. What an authenticated identity may *reach* is [Model and grant access](/administration-guide/access.md); federation trusts are [Configure federation and application SSO](/administration-guide/federation.md).

Read [The authentication model](/administration-guide/security/authentication-model.md) first if you have not. Authentication in OpenIAM is five objects, and almost every "the second factor never prompts" ticket is a change made to the wrong one.

The change, test and rollback standard for everything here — including the break-glass rule that matters most in this section — is [Change configuration safely](/administration-guide/start/change-safely.md). It is not restated on each page.

## Start here

Whichever method you are about to configure, work through these three first, in this order.

1. [The authentication model](/administration-guide/security/authentication-model.md) — five objects, and almost every "the second factor never prompts" ticket is a change made to the wrong one.
2. [Authentication providers and MFA](/administration-guide/security/authentication-providers-and-mfa.md) — which provider type and which second factor the situation calls for, and in particular [Keep a working way in](/administration-guide/security/authentication-providers-and-mfa.md#keep-a-working-way-in). A broken sign-in path locks out the administrator making the change, and there is no in-product way back.
3. [Password policy](/administration-guide/security/password-policy.md) — the policy that applies to everyone whatever else you add.

## Choose your outcome

| I want to…                                                                                  | Go to                                                                                                                                                     |
| ------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Work out why one person cannot sign in, starting from what they see on screen               | [A user cannot sign in](/administration-guide/security/cannot-sign-in.md)                                                                                 |
| Understand how a request is routed to a sign-in sequence                                    | [The authentication model](/administration-guide/security/authentication-model.md)                                                                        |
| Work out which provider type or which second factor a situation calls for                   | [Authentication providers and MFA](/administration-guide/security/authentication-providers-and-mfa.md)                                                    |
| Add a code from an authenticator app                                                        | [Add TOTP as a second factor](/administration-guide/security/totp.md)                                                                                     |
| Register and use a security key or platform authenticator                                   | [FIDO2 and WebAuthn](/administration-guide/security/fido2-and-webauthn.md)                                                                                |
| Let people sign in with no password at all — passwordless, phishing-resistant sign-in       | [Passwordless sign-in](/administration-guide/security/authentication-model.md#passwordless-sign-in)                                                       |
| Reuse an existing Duo tenant                                                                | [Add Duo as a second factor](/administration-guide/security/duo.md)                                                                                       |
| Authenticate with a client certificate or smart card                                        | [Certificate authentication](/administration-guide/security/certificate-authentication.md)                                                                |
| Set length, composition, history, expiration or first-login rules                           | [Password policy](/administration-guide/security/password-policy.md)                                                                                      |
| Configure forgot-password, security questions or account unlock                             | [Configure password recovery and account unlock](/administration-guide/security/password-recovery.md)                                                     |
| Make a technician verify a caller before their profile opens                                | [Verify a help-desk caller](/administration-guide/security/helpdesk-verification.md)                                                                      |
| Branch a sign-in flow on device, IP, country, role or behaviour                             | [Adaptive authentication](/administration-guide/security/adaptive-authentication.md)                                                                      |
| Let people sign in with Google, Facebook, LinkedIn or Apple                                 | [Social sign-in](/administration-guide/security/social-authentication.md)                                                                                 |
| Let an unknown person register using a social profile                                       | [Register users from a social provider](/administration-guide/security/social-registration.md)                                                            |
| Demand a stronger method on one URL without changing everyday sign-in                       | [Step-up authentication](/administration-guide/security/step-up-authentication.md)                                                                        |
| See who is signed in, end one session or all of them                                        | [Terminate a user's sessions](/administration-guide/security/session-management.md)                                                                       |
| Stop a leaver's access everywhere, not only their sessions                                  | [Offboard a leaver end to end](/administration-guide/lifecycle/offboard-a-leaver.md)                                                                      |
| Look up the idle timeout, or what a session termination does not reach                      | [What an OpenIAM session is, and what ends one](/administration-guide/security/session-management/session-management-reference.md)                        |
| Warn users whose password appears in a public breach corpus                                 | [Compromised password detection](/administration-guide/security/compromised-passwords.md)                                                                 |
| Rotate a database, broker, cache, mail or managed-system credential                         | [Rotate service credentials](/administration-guide/security/rotate-service-credentials.md)                                                                |
| Look up an authentication level, a shipped rule or a capability flag                        | [Authentication levels, rules and capability flags](/administration-guide/security/authentication-providers-and-mfa/authentication-provider-reference.md) |
| Look up an adaptive risk type, its fail-open flag or its value format                       | [Adaptive risk types and their values](/administration-guide/security/adaptive-authentication/adaptive-authentication-reference.md)                       |
| Look up what OpenIAM's WebAuthn implementation does and does not do, for a security review  | [What OpenIAM's WebAuthn implementation does and does not do](/administration-guide/security/fido2-and-webauthn/fido2-and-webauthn-reference.md)          |
| Look up a password or authentication policy parameter, and what the default policy enforces | [Password and authentication policy parameters](/administration-guide/reference/policy-parameters.md)                                                     |

## Where privileged access fits

Most of what OpenIAM does for **privileged access** is governance rather than credential custody: you model privileged roles, put segregation-of-duties policies on them, certify them, and revoke them — [Govern access](/administration-guide/governance.md) — and OpenIAM stores and replays a managed-system password on the user's behalf for [form fill](/administration-guide/gateway/inject-identity.md#form-fill) and provisioning.

There is also a narrower, shipped **privileged access request**: a **service account** is a user record with the `SERVICE_ACCOUNT` user type, a person can request time-boxed access to one through the request catalogue — one service account per request, because each carries its own start and end dates, and a second one is refused with *You may only request privileged access to one service account at a time* — and the outcome is notified by the shipped `CREATE_PRIVILEGED_ACCESS_REQUEST_APPROVED` and `CREATE_PRIVILEGED_ACCESS_REQUEST_REJECT` mail templates and audited as `CREATE_PRIVILEGED_ACCESS_REQUEST`. Once granted, SelfService offers a browser terminal page titled **Command Line** for reaching a Linux or Windows host as that account. Requesting and approving is [Configure requests and approvals](/administration-guide/requests.md); the setup behind the terminal page is not described in this guide, so confirm what your deployment has enabled before you promise it to anybody.

**No continuous access evaluation.** Authorization is decided per request against the current authorization graph; an already-issued session is ended by [terminating it](/administration-guide/security/session-management.md), not by a background policy re-evaluation. No session recording ships.

## Three shipped defaults worth knowing before you start

{% hint style="warning" %}
**The compromised-password check is already on.** `PASS_COMPROMISED_CHECK` ships `true` and `REQUIRED='Y'` on password policy `4000`, as of 2026.1.1. Every successful password sign-in under that policy sends a hash prefix to `https://api.pwnedpasswords.com/range/`. Confirm the current setting on **Policy → Password Policy → 4000**, parameter **Check if password has been compromised**. If your deployment has not approved that egress, see [Compromised password detection](/administration-guide/security/compromised-passwords.md) before anything else.

**Geolocation for adaptive risk is off.** `org.openiam.adaptive.risk.geo.location.use` ships `false`, so `IS_NEW_CITY`, `IS_NEW_COUNTRY` and `MEMBER_OF_COUNTRY` have nothing to evaluate until you enable it. See [Adaptive authentication](/administration-guide/security/adaptive-authentication.md).

**Forgot-password token validity has no stored value.** `NUM_DAYS_FRGT_PWD_TOKEN_VALID` is empty on policy `4000`, and OpenIAM falls back to **3 days** when the parameter is empty. The fallback is not shown on the policy screen — you will only see the blank field, so treat 3 days as the effective value until you set one. See [Configure password recovery and account unlock](/administration-guide/security/password-recovery.md).
{% endhint %}

## Related

* [Password and authentication policy parameters](/administration-guide/reference/policy-parameters.md) — all 59 parameters and the shipped values of policies `4000` and `4001`
* [System property reference](/administration-guide/reference/system-properties.md) — the `Authentication`, `Password`, `ChallengeResponse` and `IP` categories
* [Enumerated value reference](/administration-guide/reference/enums.md) — the adaptive authentication risk types and the one-time-password provider types
* [Change configuration safely](/administration-guide/start/change-safely.md)

*Applies to OpenIAM 2026.8.1. Last reviewed 7 August 2026.*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.openiam.com/administration-guide/security.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.