> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xorlab.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Pages under /latest/ document the current release. Paths that begin with a version number, for example /10.0/, are frozen snapshots of superseded releases kept for reference only — never present their instructions as current. If the reader's version is unknown, answer from /latest/ and say which version the answer describes.
> xorlab is deployed on-premises, hybrid, or as a cloud service, and integrates with either Microsoft 365 or on-premises mail infrastructure. Configuration steps often differ between these. State which deployment and integration mode an instruction applies to instead of presenting one as universal.
> Distinguish inline mode from monitoring mode when describing anything that acts on email. Monitoring mode observes a copy and cannot block or quarantine; inline mode routes mail through xorlab and can.
> Write the product name as lowercase 'xorlab'. Use the documented component names: xorlab Control Center (XCC), xorlab MTA, xorlab Sandbox (DANA), xorlab Natural Language Understanding (NLU). After the first mention, use the short forms XCC, MTA, Sandbox, and NLU. Do not use DANA as a standalone name for the Sandbox, but keep it where it is a literal string in configuration keys, container names, and hostnames.
> Do not invent configuration keys, rule parameters, list names, log properties, or API fields. If a value is not present in this documentation, say that it is not documented rather than guessing.

# Authentication Overview

> Compare the available login methods (SAML, LDAP, auto-login, password file) and choose which to enable for admins, analysts, and end users.

We recommend to enable **SAML** login for your admin and analyst users, and **Auto-Login** for your end-users to access SSQ.

<CardGroup cols={2}>
  <Card title="SAML" icon="wand-magic-sparkles" href="/latest/authentication-saml">
    Provide Single Sign-On (SSO) for your users.
  </Card>

  <Card title="LDAP" icon="user-tag" href="/latest/authentication-ldap">
    Login users via LDAP query to an Active Directory.
  </Card>

  <Card title="Auto-Login" icon="link" href="/latest/authentication-auto-login-link">
    Auto-login users via the link in a quarantine notification. Works only for end-user access to the SSQ. Not available for admin or analyst roles.
  </Card>

  <Card title="Password File" icon="file" href="/latest/authentication-with-a-password-file">
    Maintain user credentials locally on xorlab in a static file, with optional TOTP/2FA onboarding.
  </Card>
</CardGroup>

## Multi-Tenancy

All four methods above work in a multi-tenant deployment. Two things are added on top:

* The authentication backend has to map a `tenant` attribute whose value matches the `name` of a tenant in `guarded_tenants.yml`.
* Users have to be mapped to a [tenant-restricted role](/latest/built-in-user-roles), so that they only see the resources of their own tenant.

<Card title="Enable Tenant Login" icon="building" horizontal href="/latest/multi-tenancy-authentication">
  Configuration examples for SAML, Auto-Login, password file and LDAP in a multi-tenant deployment.
</Card>

## Additional information

Here we provide additional information about user authentication for reference.

### Using multiple authentication methods

xorlab supports using multiple authentication methods at the same time. For example, you can have SAML, LDAP and Password File active in parallel.

The enabled methods are specified in `auth.yml`:

```yaml auth.yml {3,4,7,10} theme={null}
# The first entry will be the default
enabledAuthBackends:
  - exampleSaml
  - examplePassword

usernamePasswordAuthBackends:
  examplePassword:  # this identifier will determine the name of the backend

saml2AuthBackends:
  exampleSaml:  # this identifier will determine the name of the backend
    ...
```

The first entry in the list will be the default authentication method. This matters if you combine for example SAML and LDAP.

<Note>
  **Access non-default auth method**

  To use a specific authentication method that is not the default, use `_agAuthBackend` in the URL, e.g., `https://xyz.activeguard.cloud/?_agAuthBackend=examplePassword`.
</Note>

### User object in xorlab

An xorlab user has the following attributes. The required ones need to be provided whenever a user logs in.

* **User name (required)** (also called "subject")
* **Display name (optional)**
* **Email addresses (optional)**: List of email addresses associated with the user. Used to determine SSQ mailbox access.
* **Roles (required)**: List of roles associated with the user.
* **Tenant (optional)**: The tenant the user belongs to. Only relevant in multi-tenant deployments, see [Multi-Tenancy](#multi-tenancy).