> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation. # Manage login options In Entrust Identity as a Service (IDaaS), login options control which sign-in methods users can choose on an application sign-in page. This page provides reference details for supported login options, requirements, and behavior by application type. For step-by-step procedures to configure combined username and password entry, forgot-password link behavior, and portal switching, see [Optimize the login flow for an application](/docs/customization/optimize-login-flow-per-application.md). Configure login options from the **Customization** tab for supported applications (see [Manage applications](/docs/applications-and-sso/manage-applications.md)). For the User Portal and the Administration Portal, configure options through [authentication flows](/docs/authentication-and-security/create-and-manage-resource-rules/create-authentication-flows.md) and portal [resource rules](/docs/authentication-and-security/create-and-manage-resource-rules/create-resource-rules.md). At least one supported login option must be enabled for each application. ## How support and selection work Use the following model when reading this page: - **Application support.** Each application type supports a specific set of login options. - **Administrator selection.** Some application types let administrators choose options. When an application supports more than one login option and shows the **Login Options** selector, administrators can choose which supported options are presented to users. If only one login option is supported for an application type, the **Login Options** selector might not appear because there are no alternatives to choose from. ## Available login options The following login options can be available, depending on application type, template, and tenant capabilities. | Login option | What it does | Requirements | | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **User Login** | User enters their user ID and authenticates by using authenticators configured in IDaaS. | Configure [authentication flows](/docs/authentication-and-security/create-and-manage-resource-rules/create-authentication-flows.md) and [resource rules](/docs/authentication-and-security/create-and-manage-resource-rules/create-resource-rules.md) for the application. | | **Smart Login** | Certificate-based authentication that is supported by Entrust Smart Credential and the Entrust Identity Mobile app. | [Smart Login](/docs/authentication-and-security/manage-smart-login.md) must be enabled and configured for your tenant. | | **IdP Login** | User authenticates through an external Identity Provider (IdP). This flow can also include optional IDaaS second-factor authentication, based on configuration. | Configure [Identity Providers](/docs/identity-providers.md) and include the flow in your authentication configuration. | | **Passkey Login** | In this flow, the user identity is provided by the passkey. Passkey can also be used as second-factor authentication with User Login or IdP Login flows. | Configure [passkey/FIDO2 authenticators](/docs/authentication-and-security/manage-authenticators/manage-passkey-fido2-authenticators.md). | | **User Certificate Login** | Smart card login supported by the browser, using either an IDaaS smart credential identity or an external certificate identity. | Configure [user certificate authenticators](/docs/authentication-and-security/manage-authenticators/manage-user-certificate-authenticators.md). | ## Additional settings for User Login For User Portal, Administration Portal, SAML, and OIDC/OAuth applications, selecting **User Login** can enable additional settings. ### Prompt for password on User ID page When this setting is enabled, users enter user ID and password on the same page. - **Default behavior.** User enters their user ID first, then enters password on a following page. - **Combined page behavior.** If user ID or password is incorrect, IDaaS does not indicate which value is wrong. This reduces user ID enumeration risk. attention If combined user ID and password entry is enabled but the applicable resource rule does not allow password authentication, authentication fails. ### Show forgot password link on combined login page When **Prompt for password on User ID page** is enabled, an additional setting is available to show a forgot password link on the combined page. When this setting is enabled, the forgot password link can be shown even if password reset is not enabled in the user's policy. ### Allow switching between User and Administrator sign-in links When **User Login** is enabled, you can allow users to switch between User and Administrator sign-in links. - User Portal and Administration Portal use the same URL. - If the authenticating user is an administrator, authentication is evaluated with Administration Portal rules. - Otherwise, authentication is evaluated with User Portal rules. If the User Portal and the Administration Portal are configured with different login options, an administrator might not be able to authenticate from the default User Portal login experience. This setting adds links that let users switch between User and Administrator login experiences. Links are shown only when the two portal applications are configured with different login options. ## Login option support by application type Use this table as a quick reference for supported login options by application type. | Application type | User Login | Smart Login | IdP Login | Passkey Login | User Certificate Login | | ----------------------- | ---------- | ----------- | --------- | ------------- | ---------------------- | | SAML applications | Yes | Yes | Yes | Yes | Yes | | OIDC/OAuth applications | Yes | Yes | Yes | Yes | Yes | | RADIUS applications | Yes | No | No | No | No | | Authentication API | Yes | No | No | No | No | | User Portal | Yes | Yes | Yes | Yes | Yes | | Administration Portal | Yes | Yes | Yes | Yes | Yes | ## Related tasks - [Create and manage resource rules](/docs/authentication-and-security/create-and-manage-resource-rules/create-resource-rules.md) - [Create authentication flows](/docs/authentication-and-security/create-and-manage-resource-rules/create-authentication-flows.md) - [Manage Smart Login](/docs/authentication-and-security/manage-smart-login.md) - [Manage Passkey/FIDO2 authenticators](/docs/authentication-and-security/manage-authenticators/manage-passkey-fido2-authenticators.md) - [Manage user certificate authenticators](/docs/authentication-and-security/manage-authenticators/manage-user-certificate-authenticators.md) - [Manage Identity Providers](/docs/identity-providers.md)