Skip to content

Sign-In Providers FAQ

Answers to common questions about sign-in providers, identity linking, and the sign-in experience.

General

How many providers can I have?

As many OIDC and SAML providers as you need, side by side, plus at most one Email & Password provider. Each enabled provider appears as its own button on the sign-in page.

Do configured providers take over sign-in immediately?

Only on deployments that use the new authentication mode. Existing deployments keep their current sign-in method until the new mode is enabled for them; until then, providers can be configured and tested in advance without affecting how anyone signs in.

Who can manage sign-in providers?

Only users with the Admin role. See the Permissions page.

Access Restrictions

What happens when the Allowed Email Domains list is empty?

All domains are allowed. The restriction only applies when the list has at least one domain; the same is true for Allowed Groups.

Why can't I save a more restrictive policy?

Qualytics refuses changes that would lock out the administrator making them: your own email domain must stay in the allowed domains, at least one of your groups must stay in the allowed groups, and you cannot disable the provider your current session signed in with.

My identity provider does not report verified emails. What should I do?

Nothing. Require verified email is off by default, because the OIDC standard does not require providers to report verification and many do not. Turn it on whenever your provider reports it reliably: it then refuses to link an identity to an existing account or create a new one for it, while sign-ins by already-linked users continue to work.

Identity Linking

A user already has an account. Can they sign in through a new provider?

Yes, when Cross-provider account linking is enabled on that provider. The new identity is linked to the existing account, either automatically or after an administrator approves it in Link approvals, depending on the provider's settings.

No notification is sent. While pending, the sign-in page tells them the request awaits administrator approval; after approval, their next sign-in succeeds; after rejection, the sign-in page tells them to contact an administrator.

Sessions and Passwords

How long do sessions last?

Each provider sets its own Session Duration (480 minutes by default). Activity extends the session up to a deployment-wide maximum lifetime (24 hours by default); after that, the person signs in again.

What ends sessions early?

Disabling a provider, saving security-sensitive provider changes, resetting a password, deactivating a user, and rejecting a pending link all end the affected sessions. The UI warns you before any change that signs users out.

How does a user recover a forgotten password?

Through the Reset Password link on the sign-in page. The reset link is emailed and expires after the period configured on the Email & Password provider (60 minutes by default). Administrators cannot set a password on a user's behalf.

How do I add users when only identity providers are enabled?

Accounts are created at the first sign-in when Automatic user provisioning is on, or ahead of time through Directory Sync. Email invitations require an enabled Email & Password provider.