Authentication and Identity

ExaVault separates a user's account from the system that verifies the user's identity. Administrators create or provision the account, choose its authentication method, and configure any identity provider or directory that method requires.

Web Authentication

An account using Internal DB authenticates with a password stored and validated by ExaVault. Two-Factor Authentication can add an authenticator-app, SMS, or email verification step to password-based web sign-in.

Single Sign-On, SAML, and SCIM documents SAML authentication through an identity provider and SCIM provisioning of users and groups. SAML handles web authentication, while SCIM handles account and group lifecycle.

Directory Authentication and Provisioning

Active Directory and LDAP can validate passwords against a directory. Active Directory sync can also create and update users and groups from a selected directory group. These are separate functions even though they share the same LDAP configuration.

File Transfer Authentication

FTP, FTPS, and WebDAV do not present interactive SSO or 2FA prompts. Configure protocol users with an authentication method their clients can complete. SFTP supports passwords and SSH Key Authentication. ExaVault's interactive 2FA prompt applies to the web interface, not to file-transfer protocol clients.

When a user cannot sign in, Investigating Login Failures provides a cross-protocol diagnostic path based on Activity records, connection settings, authentication method, and account state.