Authentication

Reemo verifies user identity at several levels: authentication at the portal, optionally delegated to an identity provider (SSO), and two-factor authentication (2FA) on top.

Single sign-on (SSO)

Reemo integrates with an identity provider through three methods:

  • SAML: the most common standard for web SSO (Microsoft Entra ID, Okta, Google Workspace, Auth0…).

  • OIDC (OpenID Connect): a protocol built on OAuth 2.0 (Keycloak, Authentik, Microsoft Entra ID, Okta…).

  • LDAP: querying a corporate directory (Active Directory, OpenLDAP).

Connectors are declared under SSO Connectors, at the organization or instance level depending on the deployment. Related options: Just In Time Provisioning (account creation on first sign-in), Extra Mapping (automatic assignment to groups and collections based on attributes), and sign-out through the identity provider.

Two-factor authentication (2FA)

2FA adds a second factor to sign-in. It can be enforced at the organization level: until a user has enabled it, they cannot connect to their resources. Each user then enables it from their security settings, using one of two methods:

  • Authenticator app (TOTP): paired by QR code to an app (Google Authenticator, Authy…), with recovery codes generated.

  • Passkey: registered through the browser, it is added to the password as an extra layer. FIDO2-compliant hardware keys, such as a YubiKey, are supported.

Accounts and passwords

An account can be managed by an organization or personal. The password policy — minimum length and required character families — is set at the instance level. Each user can review their active devices and authentication logs to spot an abnormal access. See Secure the organization for organization-level controls.