User authentication ensures secure access by verifying user identities. Native user management assigns licenses to users defined directly in Dawiso. Integrated user management assigns licenses based on synchronized user roles or groups. Dawiso supports the following authentication methods:
| Authentication method | User management | Description |
|---|---|---|
| In-memory authentication | Native | Stores credentials within the application for quick access. |
| LDAP | Integrated | Uses an external directory service for authentication. |
| Kerberos | Integrated | Provides secure, ticket-based authentication for networked environments. Relies on LDAP for user identity verification and authentication management. |
| Microsoft Entra SSO (formerly Azure SSO) | Integrated | Enables seamless sign-in with Microsoft credentials. |
| OpenID Connect | Integrated | Delegates sign-in to any OpenID Connect-compliant identity provider configured by an administrator. |
Each method offers different levels of integration and security based on your environment.
In-Memory
Dawiso uses PBKDF2 (Password-Based Key Derivation Function 2) to hash user credentials, protecting against brute-force and dictionary attacks.
Password storage and transmission also use Base64 encoding.
LDAP
LDAP (Lightweight Directory Access Protocol) enables centralized authentication by connecting Dawiso to an organization’s directory service. It synchronizes users, user roles, user information, and editable user attributes.
When LDAP is configured, the organization can also use Kerberos for secure, ticket-based authentication.
Microsoft Entra SSO (formerly Azure SSO)
Microsoft Entra SSO (formerly Azure SSO) allows users to securely sign in to the Dawiso application without storing passwords. Instead, Dawiso leverages OpenID Connect for authentication, enabling seamless and secure login through Microsoft Login. For more information on how it works and how to integrate Dawiso and Microsoft Entra ID, see Microsoft Entra Synchronization.
To set up your Microsoft Entra SSO, prepare the following information for the Dawiso Customer Success team:
| Required information | Description | How to obtain |
|---|---|---|
| Client ID | Unique identifier for the registered application in Microsoft Entra ID (also called Application ID). | Created during app registration in Microsoft Entra ID. For more information on how to register an application, refer to Microsoft Entra Synchronization. Found in Microsoft Entra ID (previously Azure Active Directory) > App Registrations > (All applications) > Your App Registration > Overview. |
| Tenant ID | Unique identifier for your Microsoft Entra ID tenant (also called Directory ID). | |
| Client Secret | A secure key used for authentication between Dawiso and Microsoft Entra ID. | Created after app registration in Microsoft Entra ID. For more information on how to obtain a client secret, see Microsoft Entra Synchronization. |
| Admin Group | Object ID of the Microsoft Entra ID group assigned admin access. | Found in Microsoft Entra ID under Groups > All Groups > Object ID. |
| Contributor Group | Object ID of the Microsoft Entra ID group assigned contributor access. | |
| Viewer Group | Object ID of the Microsoft Entra ID group assigned viewer access. |
Microsoft Entra self-setup
If your security policies do not allow external access, contact your Customer Success Account Manager to arrange a self-setup.
You will receive the External User Sync application, which you can install on your local device. The application connects to your Microsoft Entra ID tenant and pushes user profiles to Dawiso.
For how the application authenticates to the Dawiso REST API, see OAuth2 machine identities and application scopes.
OpenID Connect
OpenID Connect lets users sign in to Dawiso with an account from an external identity provider, without storing passwords in Dawiso. Dawiso supports one or more providers at the same time, configured in Settings > Authentication providers.
Each provider has:
- A provider key: set once at creation, immutable after. Used in the direct sign-in URL,
/login/<provider key>. - Display name, authority URL, client ID, and client authentication method.
- The login property that identifies the user in Dawiso.
- Optional: role mapping, login-page visibility, sort order, and default marking.
Login behavior
Hidden providers are excluded before Dawiso decides how to route /login. A hidden default is treated as no default, so a single remaining visible provider still auto-enters.
| Configuration | /login behavior |
|---|---|
| OIDC only method; a visible provider is default, or exactly one is visible | Redirects straight to that provider’s sign-in page. No provider-specific URL needed. |
| OIDC only method; several visible, none default | Shows one button per visible provider, labeled with its display name. |
| OIDC only method; no provider visible | Shows an empty sign-in card: no button, no error message. Make sure at least one provider stays visible. |
| OIDC alongside in-memory or LDAP credentials | Keeps the email/password form and lists visible providers as buttons below it. |
Any provider can also be reached directly at /login/<provider key>, no matter which of these configurations applies.
After a successful sign-in, the user lands on their default homepage. OpenID Connect sign-in doesn’t preserve a deep link or return URL.