> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Manage password authenticators

There are two types of password authenticators in IDaaS: [IDaaS passwords](#idaas-passwords) and [Active Directory (AD) passwords](#active-directory-ad-passwords).

Use this page to understand how each password type is validated, which policy controls apply, and when to use password-based authentication in resource rules.

## IDaaS passwords

IDaaS passwords are manually or automatically assigned to users on IDaaS.

- They are used to authenticate to an application.
- They must meet the password restrictions set in the Password Authenticator settings (see [Modify password authenticator settings](/docs/authentication-and-security/manage-authenticators/manage-password-authenticators/modify-password-authenticator-settings.md)).

## Active Directory (AD) passwords

Active Directory (AD) passwords are passwords that have already been assigned to a user on their corporate directory and not through IDaaS. AD password authentication requests are sent from IDaaS to the password agent on the gateway. The password agent uses the password entered by the user to authenticate that user with AD.

- Active Directory passwords can be used to authenticate to an application depending on the resource rule of the application. Users with AD password can have an IDaaS password assigned to them. However, during authentication, the password used by the user is checked against their Active Directory account.
- AD passwords can be used to log in the same way that an IDaaS password is used. The user enters their AD password when prompted by IDaaS to log in to their account or application.
- Updates to passwords synchronized from a directory are reflected in IDaaS after directory synchronization occurs.
- The password restrictions set out by the [password authenticator settings](/docs/authentication-and-security/manage-authenticators/manage-password-authenticators/modify-password-authenticator-settings.md) do not impact the AD passwords that can be used.

note

Configure RADIUS resource rules based on how you want Active Directory (AD) passwords to be validated:

- If your VPN server validates AD passwords directly, configure the VPN server for direct AD authentication and set **External Authentication** as the **First Factor** in the IDaaS resource rule.
- If you want IDaaS to validate AD passwords, set **Password** as the **First Factor** in the resource rule.

## Password security

The plaintext password from the client is passed to IDaaS using TLS 1.2+ to protect it with the exception of RADIUS clients configured to use MSCHAPv2 where a hash of the password is passed instead.

### If the password to be authenticated is managed in your directory

- The plaintext password is passed from IDaaS to your Enterprise Service Gateway. The password is protected in transit using TLS 1.2+.
- The agent on the Gateway validates the password by attempting an LDAP authentication request against your directory. The directory connection can be configured to use LDAPS.

### If the password to be authenticated is managed in IDaaS

- Passwords in IDaaS are stored either as a PBKDF2-derived value or as a cleartext password value. A cleartext password value is required when you use MSCHAPv2 with RADIUS. In both cases, the IDaaS database is encrypted with per-tenant encryption keys.
- The password is validated by IDaaS.

For both password authentication management in your directory or in IDaaS, the authentication response is processed in IDaaS and the authentication result is returned to the client.

## Multiple passwords

IDaaS supports multiple passwords, called **Named Passwords**, and each can have its own policy. The default password is IDaaS-managed for unsynchronized users. For synchronized users, AD and LDAP passwords are managed in the directory. Unsynchronized users can also have IDaaS-managed Named Passwords.

For example, a bank user has multiple passwords:

- A password to use the ATM
- A password for online (web) banking

Each password has a different policy. The online banking password must be at least 12 characters long and can contain any type of character. The ATM password is 4 characters long and only contains numeric digits.

In this example, the user needs two different passwords: one for ATM and one for online banking, each with different policy settings.

## Password functionality

The password functionality available to administrators is based on their system-defined role, as described in the following table:

| Name of role            | Password functionality available                                                                                                                                                                 |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Auditor                 | View-only access to existing passwords and configured password settings. Assign passwords to their own account from the User Portal.                                                             |
| Super Administrator     | Complete control over the passwords assigned to users (including their password history). Modify the password authenticator settings and the resource rules that define when passwords are used. |
| Issuance Administrator  | Complete control over the passwords assigned to IDaaS Issuance users (including their password history). Modify the password authenticator settings and the resource rules that define usage.    |
| Issuance Operator       | Can only reset their own password.                                                                                                                                                               |
| Help Desk Administrator | Manage passwords assigned to other user accounts (including clearing the password history). Cannot modify the password authenticator settings or resource rules related to them.                 |
| User-defined roles      | Password functionality available depends on the settings of each role. Click the name of a user-defined role to determine the level of password functionality available.                         |

## Topics in this section

[📄️Settings Password authenticator settings determine the requirements for IDaaS passwords, including password reset.](/docs/authentication-and-security/manage-authenticators/manage-password-authenticators/modify-password-authenticator-settings.md)

[📄️Blocklist The password blocklist contains words and strings that users cannot include in their passwords.](/docs/authentication-and-security/manage-authenticators/manage-password-authenticators/manage-password-blocklist.md)

[📄️Assign an authenticator You can assign a password authenticator to a user account.](/docs/authentication-and-security/manage-authenticators/manage-password-authenticators/assign-a-password-authenticator.md)

[📄️Manage authenticators After you assign a password authenticator to a user, you can manage these password authenticator actions:](/docs/authentication-and-security/manage-authenticators/manage-password-authenticators/view-edit-delete-password-authenticators.md)