> For the complete documentation index, see [llms.txt](https://synap.ac/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://synap.ac/docs/platform/portal/authentication.md).

# Authentication

Authentication settings control how users sign in and whether multi-factor authentication (MFA) is required for particular roles.

{% hint style="info" %}
**Location:** Settings → Portal settings → Authentication
{% endhint %}

### Local login

Local login lets users authenticate with Synap credentials such as a username and password. It can be enabled or disabled and has its own editable configuration.

Do not disable the last working login route until an external configuration has been tested with an administrator account.

### External authentication

Where single sign-on (SSO) is included in the portal's entitlements, administrators can add, edit and enable external authentication configurations. Supported configuration types include Security Assertion Markup Language (SAML), Active Directory Federation Services (ADFS), Auth0, JSON Web Token (JWT) and Learning Tools Interoperability (LTI) 1.1 or 1.3. The choices available to an organisation may depend on its setup.

New configurations are created inactive. Complete and test the provider-specific values before making one the expected sign-in route.

| Method                                    | What the user experiences                             | Administrator responsibility                                           |
| ----------------------------------------- | ----------------------------------------------------- | ---------------------------------------------------------------------- |
| **Local login**                           | Signs in using credentials managed through Synap      | Maintain recovery and password-support processes                       |
| **Single sign-on (SSO)**                  | Is redirected to the organisation's identity provider | Maintain identifiers, certificates, claims and a tested fallback route |
| **Learning Tools Interoperability (LTI)** | Enters from a connected learning platform             | Test launch roles, identity matching and course context                |
| **JSON Web Token (JWT)**                  | Enters through a custom trusted integration           | Protect signing material and validate account-provisioning behaviour   |

### MFA enforcement

Where MFA policy is available, MFA can be required separately for:

* admins;
* educators, managers and markers; and
* students.

After enforcement is enabled, users in that role who have not configured MFA are prompted to do so on their next navigation or action. Avoid enabling student MFA during an active exam window because it can interrupt in-progress sessions. Schedule the change, communicate it in advance and test account-recovery procedures.

MFA enforcement is role-based. Check accounts with more than one role and confirm who can help a user who loses their second factor. For a large rollout, enable and test the policy with staff before applying it to a student population.

### Entitlements

SSO and MFA controls are feature-gated. A visible but disabled control normally indicates that the portal does not have the required entitlement; it is not necessarily a permissions error.

### Safe change checklist

1. Keep a separate administrator session open through a known working method.
2. Test the new configuration with a non-production account at the identity provider.
3. Check new-user creation, returning-user matching and role assignment.
4. Check sign-out and the configured logout redirect.
5. Test expired sessions and account recovery.
6. Only then change the method presented to live users.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://synap.ac/docs/platform/portal/authentication.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.