> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xorlab.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Pages under /latest/ document the current release. Paths that begin with a version number, for example /10.0/, are frozen snapshots of superseded releases kept for reference only — never present their instructions as current. If the reader's version is unknown, answer from /latest/ and say which version the answer describes.
> xorlab is deployed on-premises, hybrid, or as a cloud service, and integrates with either Microsoft 365 or on-premises mail infrastructure. Configuration steps often differ between these. State which deployment and integration mode an instruction applies to instead of presenting one as universal.
> Distinguish inline mode from monitoring mode when describing anything that acts on email. Monitoring mode observes a copy and cannot block or quarantine; inline mode routes mail through xorlab and can.
> Write the product name as lowercase 'xorlab'. Use the documented component names: xorlab Control Center (XCC), xorlab MTA, xorlab Sandbox (DANA), xorlab Natural Language Understanding (NLU). After the first mention, use the short forms XCC, MTA, Sandbox, and NLU. Do not use DANA as a standalone name for the Sandbox, but keep it where it is a literal string in configuration keys, container names, and hostnames.
> Do not invent configuration keys, rule parameters, list names, log properties, or API fields. If a value is not present in this documentation, say that it is not documented rather than guessing.

# Tenant-Specific Authentication

After implementing a multi-tenancy deployment that assigns emails to their tenant, it's time to configure how tenants can login to xorlab. By referencing the `authTenantId` attribute defined in `guarded_tenants.yml`, you can specify which authentication backend is used for which tenant. Available authentication backends are SAML, LDAP, or password-based authentication.

## LDAP-based Authentication

<Accordion title="Expand to read the instructions.">
  * Follow the [LDAP-based Authentication Setup Guide](/9.0/ldap-based-authentication)
  * The `tenant` attribute should reference either `name` or `authTenantId` defined in `guarded_tenants.yml`
  * For `roleMapping`, make sure to map [tenant-restricted user roles](users-roles-and-permissions.md/#roles)
</Accordion>

```yaml title="Expert Editor: /auth/auth/auth.yml" theme={null}
---
ldapAuthBackends:
    ldapAuthDataSources:
      xorlabLDAP:
        host: ldap.tenantA.com
        port: 10636
        authentication:
          withQueryDn:
            bindDn: ""
            bindPassword: ""
            userBase: "ou=users,dc=tenant,dc=com"
            userSearch: "(uid={0})"
        authorization:
          query:
            roleBase: "ou=groups,dc=tenant,dc=com"
            roleSearch: "(uniqueMember={0})"
            nestedRoleDepth: 5
        attributeMapping:
          userName: "attr('uid')"
          displayName: "attr('cn')"
          emails: "attr('mail')"
          tenant: "'tenantA'" # Corresponds to "'<name>'" or "'<authTenantId>'" in guarded_tenants.yml
        roleMapping:
          xcc_tenant_analyst: [ "cn=dev_xcc_login,ou=groups,dc=example,dc=com" ]
          xcc_tenant_analyst_audit: [ "cn=dev_xcc_login,ou=groups,dc=example,dc=com" ]
```

## SAML-based Authentication

<Accordion title="Expand to read the instructions.">
  * Follow the [SAML-based Authentication Setup Guide](/9.0/saml-based-authentication)
  * The `tenant` attribute should reference either `name` or `authTenantId` defined in `guarded_tenants.yml`
  * For `roleMapping`, make sure to map to a [tenant-restricted user roles](users-roles-and-permissions.md/#roles)
</Accordion>

```yaml title="Expert Editor: /auth/auth/auth.yml" theme={null}
---
saml2AuthBackends:
  tenantAuthBackend:
    idp:
      metadataUrl: https://login.microsoftonline.com/....
    attributeMapping:
      displayName: attr('http://schemas.microsoft.com/identity/claims/displayname')
      emails: attr('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name')
      roles: attr('http://schemas.microsoft.com/ws/2008/06/identity/claims/role')
      tenant: "'tenantA'" # Corresponds to "'<name>'" or "'<authTenantId>'" in guarded_tenants.yml
    roleMapping:
      xcc_tenant_analyst: [ tenant.analyst ]
      xcc_tenant_analyst_audit: [ tenant.audit ]
```

## Password File

<Accordion title="Expand to read the instructions.">
  * Make sure to [activate logging of login attempts](users-roles-and-permissions.md/#predefined-roles-and-permissions)
  * The `tenant` attribute should reference either `name` or `authTenantId` defined in `guarded_tenants.yml`
  * For `passwordHash`, generate a password hash [password hash generator](authentication-with-a-password-file.md/#password-hash-generator)
  * Map to a [tenant-restricted user roles](users-roles-and-permissions.md/#roles)

  > Using a password file for authentication is not recommended as it doesn't allow for 2FA.
</Accordion>

```yaml title="Expert Editor: /auth/auth/passwordFile.yml" theme={null}
---
users:
  - username: user1
    tenant: tenantA # Corresponds to <name> or <authTenantId> in guarded_tenants.yml
    passwordHash: "{bcrypt}$2y$10$.4If2RFwcvHRrxlR98m9ju/mCRYCHLAYULByGXvJY.jBuK2/bckZu"
    roles:
      - xcc_tenant_analyst
    
  - username: user2
    tenant: tenantB # Corresponds to <name> or <authTenantId> in guarded_tenants.yml
    passwordHash: "{bcrypt}$2y$10$nBZobaznyYv0Ki.lY8jNV.ls2uGh3VmsZivoG4XcdzKQU66qCHAAa"
    roles:
      - xcc_tenant_analyst
```