> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Optimize the login flow for an application

By default, IDaaS presents the username on one page and the password on the next. For password-based authentication, this multi-step flow adds an extra page transition and increases friction. Combining username and password on a single page reduces friction and prevents user ID enumeration. When both fields are submitted together, an attacker cannot determine whether an account exists based on the server's response.

This procedure focuses on configuring combined username and password entry, forgot-password link behavior, and portal switching for a specific application. For a complete reference of login options, requirements, and support by application type, see [Manage login options](/docs/applications-and-sso/manage-applications/manage-login-options.md).

Additionally, when administrators and end users have different login experiences (different authenticators, policies, or branding), you can enable a portal-switch link so administrators can easily reach the admin sign-in page without needing to know a separate URL.

## Before you begin

Before you begin, you need:

- A **Site Administrator** role with permission to modify customization settings and the `applications:edit` permission.
- At least one OIDC and OAuth, SAML, User Portal, or Admin Portal application configured.

## Enable combined username and password login

Combine the username and password prompts on a single page for a specific application.

1. Click Menu icon **> Security > Applications**. The **Applications List** page appears.
2. Select the application you want to configure (OIDC and OAuth, SAML, User Portal, or Admin Portal).
3. Open the **Customization** tab.
4. Under **Login Options**, enable **Prompt for password on User ID page**.
5. Click **Save**.

When this setting is enabled:

- The login page displays both the username and password fields on a single page.
- If credentials are incorrect, the error appears immediately on the same page without revealing whether the username exists.
- If the user has additional second-factor authenticators configured, the flow advances to the next challenge after the password is validated.

note

Combined login is only supported when the user is expected to authenticate with a password. Applications that rely exclusively on passwordless methods (passkeys, FIDO, magic links) do not support this option.

info

Combining username and password on a single page prevents user ID enumeration. With the default split-page flow, an attacker could submit different usernames on the first page and observe different responses to determine which accounts exist. The combined page submits both fields together, returning the same error regardless of whether the user ID is valid.

## Show or hide the forgot-password link

Control whether the forgot-password link appears on the combined login page.

1. On the application's **Customization** tab under **Login Options**, configure **Show forgot-password link on combined login page**.
2. Select one of the following:
   - **Enable.** Display the forgot-password link on the combined page. This is the default when combined login is active.
   - **Disable.** Hide the link. Use this for applications where users do not manage their own passwords or where password reset is handled through a separate process.
3. Click **Save**.

## Enable portal switching

When administrators and end users have different login experiences, the portal-switch link gives administrators a clear path to the admin sign-in page directly from the user login page. Without this link, administrators must manually navigate to a different URL, making their sign-in process harder.

1. On the application's **Customization** tab under **Login Options**, enable **Allow switching between User and Administrator sign-in links**.
2. Click **Save**.

info

The portal-switch link only appears when the User Portal and Admin Portal have observably different login configurations (for example, different authenticator requirements or different branding). If both portals use identical login settings, the link does not display because switching would have no effect.

## Verify

After configuring the login options:

1. Open a private browser window and navigate to the application's login URL.
2. Confirm that the username and password fields appear on the same page (if combined login is enabled).
3. Enter an invalid username and password combination and confirm that the error message does not reveal whether the account exists.
4. If you enabled portal switching, confirm the portal-switch link appears and navigates to the correct admin sign-in page.
5. Sign in as an administrator and confirm the portal-switch link works in the opposite direction.

## Next steps

- [Brand your login pages](/docs/customization/brand-your-login-pages.md) to apply consistent visual branding across all applications.
- [Customize the login page layout](/docs/customization/customize-login-layout-and-flow.md) to control card style and login flow order at the tenant level.