> For the complete documentation index, see [llms.txt](https://docs.strongdm.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.strongdm.com/concepts/security/authentication-and-identity-federation.md). # Authentication and Identity Federation ### General Security Settings #### Timeouts StrongDM allows customers to define timeouts for Client session length and Client and AdminUI idle periods to suit the customer's specific needs. ### Brute Force Attacks There are countermeasures in place to combat brute force account attacks. A user's account will be automatically locked after five failed authentication attempts. The lock is removed after five minutes, after which the user can attempt to log in again. This automatic lockout period greatly limits the efficacy of a brute force attack. ### OIDC Federation & SSO #### Multi-factor authentication StrongDM has multiple options for the enforcement of multi-factor authentication on StrongDM client sessions, which can be found in the [MFA section](/admin/principals/mfa.md). ### Native Authentication #### Password requirements When using StrongDM's native authentication, customer administrators can enforce minimum password requirements for all users. #### Password Hashing All user passwords are hashed using the `bcrypt`, with at least 13 rounds. Passwords are never stored or logged in plain text. StrongDM regularly revisits the chosen hashing algorithm and number of rounds to ensure we are adhering to industry best practices. ### Identity Federation StrongDM allows customers to federate with a variety of Identity Providers to manage user identity and authentication. #### OIDC SSO In addition to offering integrations with a variety of SSO providers, StrongDM also allows the use of any OpenID Connect (OIDC)-compliant SSO service. Support for OIDC in general opens the door to many more providers than StrongDM would otherwise create and maintain specific integrations for, while not compromising on security. #### User Provisioning StrongDM integrates with Okta and Microsoft Entra ID (formerly Azure AD) to enable SCIM-based user provisioning, allowing customers to manage their users within their centralized Identity Provider. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.strongdm.com/concepts/security/authentication-and-identity-federation.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.