> ## Documentation Index
> Fetch the complete documentation index at: https://docs.validio.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Validio supports user and password and SAML 2.0 single sign-on authentication methods.

Validio supports the following authentication methods:

* **User and password** (default) — credentials held in Validio by the local identity provider. See [User and password](#user-and-password).
* **Single sign-on (SSO)** — authentication through your organization's identity provider, using [SAML 2.0](https://docs.validio.io/v11.1/docs/security/authentication/saml-sso.md).

Each method is configured as an **identity provider** under **Workspace > Users > Identity Providers**. You can run more than one at a time, so single sign-on can sit alongside password access rather than replacing it. For the configuration steps, see [Managing Users and Identity Providers](https://docs.validio.io/v11.1/docs/access-and-settings/settings/managing-users-and-idps.md).

## User and password

The local identity provider authenticates users with credentials held in Validio, and is the default for a new workspace. On a [VPC deployment](https://docs.validio.io/v11.1/docs/deployment/virtual-private-cloud/vpc-deployment.md), the first sign-in uses the admin credentials created in the Kubernetes Secret during installation.

When you create a user, check **Create username and password** to assign credentials manually. Users change their own password from the **Account** page, which also lists the password requirements Validio enforces — see [Platform Configuration](https://docs.validio.io/v11.1/docs/access-and-settings/settings.md).

### Guest access alongside SSO

The **Guest** login type is the exception to single sign-on. A Guest signs in with a username and password even when the local identity provider is disabled, which makes it the way to give access to external support users who are not part of your SSO provider. Guests can view everything and modify nothing, whatever role they hold. For how login types and global roles interact, see [Login types](https://docs.validio.io/v11.1/docs/access-and-settings/settings/managing-users-and-idps.md#login-types).

## Single sign-on

Single sign-on lets your team authenticate through your organization's identity provider instead of managing a second set of credentials in Validio. Validio supports SAML 2.0, which you can set up with Google Workspace, JumpCloud, Microsoft Entra ID, Okta, or CyberArk. For the provider-specific steps, see [SAML SSO](https://docs.validio.io/v11.1/docs/security/authentication/saml-sso.md).

### Provisioning users automatically

A SAML identity provider can also provision users and teams for you. Enabling **SCIM** generates an API key that your identity provider uses to push new users, profile updates, and groups into Validio, and to set users to inactive when they are removed upstream. See [SCIM synchronization](https://docs.validio.io/v11.1/docs/access-and-settings/settings/managing-users-and-idps.md#scim-synchronization).

## Managing identity providers

Two rules are worth knowing before you change how people sign in:

* **Disabling is reversible.** Check **Disable this provider** to stop users authenticating through it. You can enable it again later by updating the provider.
* **The last provider cannot be deleted.** Deleting an identity provider is only offered when your workspace has more than one configured, so you cannot lock everyone out.