Introduction
Sign-In Providers define how people authenticate to Qualytics. Administrators configure them directly in the platform under Settings > Access, in the Providers tab, instead of through deployment-level setup. Each provider is independent: you can run several at once, enable or disable them individually, and let users pick how they sign in.
Why This Matters
- Self-service: administrators add, test, and change sign-in configuration from the platform, without a deployment change or a support request.
- Multiple providers side by side: connect more than one identity provider (for example, one for employees and one for partners) and offer email and password sign-in alongside them.
- Safer changes: configuration changes that affect trust ask for confirmation, take effect immediately, and are recorded in a sign-in log.
Provider Types
| Type | What It Is |
|---|---|
| OpenID Connect | Connects an OIDC-compliant identity provider (Microsoft Entra ID, Okta, Google Workspace, Keycloak, and others). Supports endpoint discovery from a Discovery URL and claim mapping. See Add an OIDC Provider. |
| SAML 2.0 | Connects a SAML 2.0 identity provider. Configuration fields can be filled automatically from the identity provider's metadata URL or an uploaded metadata file. See Add a SAML Provider. |
| Email & Password | Lets users sign in with an email address and a password managed by Qualytics, governed by a configurable password policy. Every deployment includes one Email & Password provider, listed as Database Identity Provider until it is renamed, and only one can exist at a time. Enables inviting new users by email. See Set Up Email & Password Sign-In. |
The Sign-In Experience
The sign-in page reflects your enabled providers:
- Each enabled identity provider appears as its own Sign in with button carrying the provider's display name, so users pick how they authenticate. When only one provider is enabled, a single Sign In button is shown.
- When Email & Password sign-in is enabled, the page shows the email and password form with a Reset Password link for self-service password recovery.
What Else Lives Here
Provider management sits alongside three related tabs on the Access settings page, all Admin-only:
- Link approvals: review requests to link a new sign-in identity to an existing account. See Review Link Approvals.
- Invitations: invite new users by email and track the invitations you sent. Appears when an Email & Password provider is enabled. See Invite a User.
- Log: the audit trail of sign-in activity and provider configuration changes. See View the Sign-In Log.
Existing Deployments
Existing deployments keep their current sign-in method until the new authentication mode is enabled for them. Providers configured in the platform can be staged and verified in advance; they take over sign-in only after your deployment is switched over. For self-hosted deployments, the switch is described in the self-hosted deployment guide; for managed deployments, it is coordinated with Qualytics.
Next Steps
-
How It Works
Provisioning, identity linking, access restrictions, sessions, and the audit trail.
-
Permissions
Roles required to manage providers, approvals, invitations, and the sign-in log.