> For the complete documentation index, see [llms.txt](https://docs.exavault.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.exavault.com/authentication-and-identity.md).

# Authentication and Identity

ExaVault separates a user's account from the system that verifies the user's identity. Administrators create or provision the account, choose its authentication method, and configure any identity provider or directory that method requires.

## Web Authentication

An account using *Internal DB* authenticates with a password stored and validated by ExaVault. [Two-Factor Authentication](/authentication-and-identity/two-factor-authentication-2fa.md) can add an authenticator-app, SMS, or email verification step to password-based web sign-in.

[Single Sign-On, SAML, and SCIM](/authentication-and-identity/single-sign-on-sso-saml-and-scim.md) documents SAML authentication through an identity provider and SCIM provisioning of users and groups. SAML handles web authentication, while SCIM handles account and group lifecycle.

## Directory Authentication and Provisioning

[Active Directory and LDAP](/authentication-and-identity/active-directory-and-ldap.md) can validate passwords against a directory. Active Directory sync can also create and update users and groups from a selected directory group. These are separate functions even though they share the same LDAP configuration.

## File Transfer Authentication

FTP, FTPS, and WebDAV do not present interactive SSO or 2FA prompts. Configure protocol users with an authentication method their clients can complete. SFTP supports passwords and [SSH Key Authentication](/connection-methods/sftp/ssh-key-authentication.md). ExaVault's interactive 2FA prompt applies to the web interface, not to file-transfer protocol clients.

When a user cannot sign in, [Investigating Login Failures](/authentication-and-identity/investigating-login-failures.md) provides a cross-protocol diagnostic path based on Activity records, connection settings, authentication method, and account state.