Skip to main content

Optimize the login flow for an application

By default, IDaaS presents the username on one page and the password on the next. For password-based authentication, this multi-step flow adds an extra page transition and increases friction. Combining username and password on a single page reduces friction and prevents user ID enumeration. When both fields are submitted together, an attacker cannot determine whether an account exists based on the server's response.

This procedure focuses on configuring combined username and password entry, forgot-password link behavior, and portal switching for a specific application. For a complete reference of login options, requirements, and support by application type, see Manage login options.

Additionally, when administrators and end users have different login experiences (different authenticators, policies, or branding), you can enable a portal-switch link so administrators can easily reach the admin sign-in page without needing to know a separate URL.

Before you begin​

Before you begin, you need:

  • A Site Administrator role with permission to modify customization settings and the applications:edit permission.
  • At least one OIDC and OAuth, SAML, User Portal, or Admin Portal application configured.

Enable combined username and password login​

Combine the username and password prompts on a single page for a specific application.

  1. Click > Security > Applications. The Applications List page appears.
  2. Select the application you want to configure (OIDC and OAuth, SAML, User Portal, or Admin Portal).
  3. Open the Customization tab.
  4. Under Login Options, enable Prompt for password on User ID page.
  5. Click Save.

When this setting is enabled:

  • The login page displays both the username and password fields on a single page.
  • If credentials are incorrect, the error appears immediately on the same page without revealing whether the username exists.
  • If the user has additional second-factor authenticators configured, the flow advances to the next challenge after the password is validated.
note

Combined login is only supported when the user is expected to authenticate with a password. Applications that rely exclusively on passwordless methods (passkeys, FIDO, magic links) do not support this option.

info

Combining username and password on a single page prevents user ID enumeration. With the default split-page flow, an attacker could submit different usernames on the first page and observe different responses to determine which accounts exist. The combined page submits both fields together, returning the same error regardless of whether the user ID is valid.

Control whether the forgot-password link appears on the combined login page.

  1. On the application's Customization tab under Login Options, configure Show forgot-password link on combined login page.
  2. Select one of the following:
    • Enable. Display the forgot-password link on the combined page. This is the default when combined login is active.
    • Disable. Hide the link. Use this for applications where users do not manage their own passwords or where password reset is handled through a separate process.
  3. Click Save.

Enable portal switching​

When administrators and end users have different login experiences, the portal-switch link gives administrators a clear path to the admin sign-in page directly from the user login page. Without this link, administrators must manually navigate to a different URL, making their sign-in process harder.

  1. On the application's Customization tab under Login Options, enable Allow switching between User and Administrator sign-in links.
  2. Click Save.
info

The portal-switch link only appears when the User Portal and Admin Portal have observably different login configurations (for example, different authenticator requirements or different branding). If both portals use identical login settings, the link does not display because switching would have no effect.

Verify​

After configuring the login options:

  1. Open a private browser window and navigate to the application's login URL.
  2. Confirm that the username and password fields appear on the same page (if combined login is enabled).
  3. Enter an invalid username and password combination and confirm that the error message does not reveal whether the account exists.
  4. If you enabled portal switching, confirm the portal-switch link appears and navigates to the correct admin sign-in page.
  5. Sign in as an administrator and confirm the portal-switch link works in the opposite direction.

Next steps​