Login methods
Signicat IAM (SIAM) lets you choose how users sign in to your services.
You can configure what users enter to identify themselves—a username, an email address, or either—and decide when authenticator app code authentication (TOTP) is required. You can also enable passkeys for a faster, phishing-resistant login experience.
These settings can be adapted to your organisation’s security policies and the needs of different user groups.
Available login methods
Username and password
Username-and-password authentication is required in SIAM. Users identify themselves with a username, an email address, or either, and then enter their password.
This familiar method works across browsers and devices and provides a straightforward foundation for customer authentication.
Passwords can be guessed, reused or obtained through phishing. For accounts that need additional protection, you can require an authenticator app code (TOTP) as a second authentication factor.
You can configure login identifiers and password policies in SIAM settings.
Authenticator app code (TOTP)
A time-based one-time password (TOTP) is a six-digit code generated by an authenticator app. The code changes regularly and can only be used for a limited period. The authenticator app does not need a mobile network connection to generate it.
TOTP is used as a second factor after the user enters their username and password. It reduces the risk of account takeover because an attacker would need both the user’s password and access to their authenticator app.
You can configure when TOTP is required and how long SIAM remembers a verified device in SIAM settings.
Passkey
A passkey lets users sign in without entering a password or one-time code. Instead, they confirm their identity using their device’s screen-lock method, such as a fingerprint, facial recognition, PIN or pattern.
The private key remains protected by the user's passkey provider. SIAM uses the public key to verify a signed login challenge. The user unlocks the key with their device screen lock.
Because passkeys based on WebAuthn are linked to the website for which they were created, they are resistant to phishing and credential replay. They also provide a quick login experience without requiring users to remember a password.
Set up and manage login methods
When defining the authentication policy for your users, consider the sensitivity of the service and the impact of account takeover. NIST SP 800-63B-4 provides guidance about passwords, OTP authenticators, phishing resistance and authenticator assurance levels. Use it as a reference when assessing your requirements; enabling a method does not by itself establish compliance with a particular assurance level.
To learn how to set up, use and manage each method, select an option below: