Skip to main content
We recommend to enable SAML login for your admin and analyst users, and Auto-Login for your end-users to access SSQ.

SAML

Provide Single Sign-On (SSO) for your users.

LDAP

Login users via LDAP query to an Active Directory.

Auto-Login

Auto-login users via the link in a quarantine notification. Works only for end-user access to the SSQ. Not available for admin or analyst roles.

Password File

Maintain user credentials locally on xorlab in a static file, with optional TOTP/2FA onboarding.

​
Multi-Tenancy

All four methods above work in a multi-tenant deployment. Two things are added on top:
  • The authentication backend has to map a tenant attribute whose value matches the name of a tenant in guarded_tenants.yml.
  • Users have to be mapped to a tenant-restricted role, so that they only see the resources of their own tenant.

Enable Tenant Login

Configuration examples for SAML, Auto-Login, password file and LDAP in a multi-tenant deployment.

​
Additional information

Here we provide additional information about user authentication for reference.

​
Using multiple authentication methods

xorlab supports using multiple authentication methods at the same time. For example, you can have SAML, LDAP and Password File active in parallel. The enabled methods are specified in auth.yml:
auth.yml
The first entry in the list will be the default authentication method. This matters if you combine for example SAML and LDAP.
Access non-default auth methodTo use a specific authentication method that is not the default, use _agAuthBackend in the URL, e.g., https://xyz.activeguard.cloud/?_agAuthBackend=examplePassword.

​
User object in xorlab

An xorlab user has the following attributes. The required ones need to be provided whenever a user logs in.
  • User name (required) (also called “subject”)
  • Display name (optional)
  • Email addresses (optional): List of email addresses associated with the user. Used to determine SSQ mailbox access.
  • Roles (required): List of roles associated with the user.
  • Tenant (optional): The tenant the user belongs to. Only relevant in multi-tenant deployments, see Multi-Tenancy.