Manage login options
In Entrust Identity as a Service (IDaaS), login options control which sign-in methods users can choose on an application sign-in page.
This page provides reference details for supported login options, requirements, and behavior by application type. For step-by-step procedures to configure combined username and password entry, forgot-password link behavior, and portal switching, see Optimize the login flow for an application.
Configure login options from the Customization tab for supported applications (see Manage applications). For the User Portal and the Administration Portal, configure options through authentication flows and portal resource rules. At least one supported login option must be enabled for each application.
How support and selection work
Use the following model when reading this page:
- Application support. Each application type supports a specific set of login options.
- Administrator selection. Some application types let administrators choose options. When an application supports more than one login option and shows the Login Options selector, administrators can choose which supported options are presented to users.
If only one login option is supported for an application type, the Login Options selector might not appear because there are no alternatives to choose from.
Available login options
The following login options can be available, depending on application type, template, and tenant capabilities.
| Login option | What it does | Requirements |
|---|---|---|
| User Login | User enters their user ID and authenticates by using authenticators configured in IDaaS. | Configure authentication flows and resource rules for the application. |
| Smart Login | Certificate-based authentication that is supported by Entrust Smart Credential and the Entrust Identity Mobile app. | Smart Login must be enabled and configured for your tenant. |
| IdP Login | User authenticates through an external Identity Provider (IdP). This flow can also include optional IDaaS second-factor authentication, based on configuration. | Configure Identity Providers and include the flow in your authentication configuration. |
| Passkey Login | In this flow, the user identity is provided by the passkey. Passkey can also be used as second-factor authentication with User Login or IdP Login flows. | Configure passkey/FIDO2 authenticators. |
| User Certificate Login | Smart card login supported by the browser, using either an IDaaS smart credential identity or an external certificate identity. | Configure user certificate authenticators. |
Additional settings for User Login
For User Portal, Administration Portal, SAML, and OIDC/OAuth applications, selecting User Login can enable additional settings.
Prompt for password on User ID page
When this setting is enabled, users enter user ID and password on the same page.
- Default behavior. User enters their user ID first, then enters password on a following page.
- Combined page behavior. If user ID or password is incorrect, IDaaS does not indicate which value is wrong. This reduces user ID enumeration risk.
If combined user ID and password entry is enabled but the applicable resource rule does not allow password authentication, authentication fails.
Show forgot password link on combined login page
When Prompt for password on User ID page is enabled, an additional setting is available to show a forgot password link on the combined page.
When this setting is enabled, the forgot password link can be shown even if password reset is not enabled in the user's policy.
Allow switching between User and Administrator sign-in links
When User Login is enabled, you can allow users to switch between User and Administrator sign-in links.
- User Portal and Administration Portal use the same URL.
- If the authenticating user is an administrator, authentication is evaluated with Administration Portal rules.
- Otherwise, authentication is evaluated with User Portal rules.
If the User Portal and the Administration Portal are configured with different login options, an administrator might not be able to authenticate from the default User Portal login experience.
This setting adds links that let users switch between User and Administrator login experiences. Links are shown only when the two portal applications are configured with different login options.
Login option support by application type
Use this table as a quick reference for supported login options by application type.
| Application type | User Login | Smart Login | IdP Login | Passkey Login | User Certificate Login |
|---|---|---|---|---|---|
| SAML applications | Yes | Yes | Yes | Yes | Yes |
| OIDC/OAuth applications | Yes | Yes | Yes | Yes | Yes |
| RADIUS applications | Yes | No | No | No | No |
| Authentication API | Yes | No | No | No | No |
| User Portal | Yes | Yes | Yes | Yes | Yes |
| Administration Portal | Yes | Yes | Yes | Yes | Yes |