For the complete documentation index, see llms.txt

Username and password

Using a username or email address and a password is the standard method for your users to log in to their Signicat IAM (SIAM) user profiles.

What is username and password authentication?

The username and password authentication method combines an identifier with a secret:

• The username or email address tells SIAM which user is trying to log in. SIAM administrators choose whether users need to provide a username, an email address or both identifiers.
• The password proves that the person logging in knows the secret associated with their user profile.

Username and password authentication is widely supported and familiar to most users. It is suitable as a baseline login method, but note that passwords can be reused, guessed or disclosed through phishing.

For customer accounts that need additional protection, we recommend you combine passwords with an authenticator app code (TOTP) or offer a passkey as a phishing-resistant alternative.

Password policy

SIAM administrators can configure the password rules for your SIAM platform. To review your current password policy, go to your SIAM settings page.

Password rules

Password rules apply when users set a password during registration or invitation, change their password in their profile or reset their password, including required password resets.

Passwords must meet the minimum length, character-count and strength that you have configured in your password policy. When you enable the common-password checking setting, SIAM rejects passwords that match an entry in its common-password list. Meeting the length requirement alone does not guarantee that a password will be accepted.

To remove requirements for digits, lowercase letters, uppercase letters or special characters, SIAM administrators need to set the value of the corresponding setting to 0, or select None to remove the minimum password strength requirement. When editing a password rule, note that the other rules still apply.

It is important to note that users are not automatically required to change their existing password, after you change your password rules. To require that users change their password, you need to apply the Password policy enforcement setting, which prompts users to change an existing password that no longer meets the configured rules. Note that password expiration and password reuse prevention are configured separately.

Password guidance

As a SIAM administrator, you should encourage users to choose long, unpredictable passwords or passphrases and use a password manager. Remember that a long password can still be predictable, so users should avoid common phrases and repeated patterns.

When defining your policy, we recommend you follow these password guidelines in NIST SP 800-63B-4. Your SIAM platform's alignment depends on its configured password rules and the wider authentication setup. The available settings alone do not establish compliance with the full standard.

Common user journeys

These are common journeys you should expect your users to complete when using username and password authentication:

• Log in to your SIAM platform using credentials.
• Update login credentials.
• Reset a forgotten password using a password reset email.

How to log in

To log in using username and password as the authentication method, users needs to complete these steps:

1. Go to your SIAM platform URL.
2. Enter their username, email address or both, depending on your SIAM login settings configuration.
3. Enter their password.
4. Click Log in.
5. Optional. If their profile requires an authenticator app code, users need to complete any additional verification step.

How to update login credentials

To update their login credentials, users needs to complete these steps:

1. Log in to your SIAM platform.
2. Click their user icon in the top navigation bar.
3. From the dropdown menu, select Manage profile to open the Personal info page.
4. In the Login credentials section, click Edit beside the credentials to update.
   Available credentials

   Users can update their email address, username and password.

5. In the dialog, enter their current password and the updated credential.
6. Clicks Save.

How to reset a forgotten password

When users forget their password, SIAM can send a reset link to the email address associated with their profile. To request a new password, users need to complete the following steps:

1. Go to your SIAM platform URL.
2. On the login page, click Forgot your password?.
3. Enter the email address associated with their SIAM user profile.
4. Click Send reset link.
5. Open the password reset email and follow the link to the password reset page.
6. Enter and confirm their new password, then submit the form.

If users do not receive the email, they should check their spam folders or contact your SIAM administrator for help.