# Most secure authentication? **URL:** \ **Category:** Ignition\ **Tags:** ignition81\ **Created:** [May 22, 2024, 3:07pm UTC](https://forum.inductiveautomation.com/t/most-secure-authentication/90742 "2024-05-22T15:07:31Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Jason\_Crockett](https://avatars.discourse-cdn.com/v4/letter/j/e99b99/32.png) [@Jason\_Crockett](https://forum.inductiveautomation.com/u/Jason_Crockett)\ **Post date:** [May 22, 2024, 3:07pm UTC](https://forum.inductiveautomation.com/t/most-secure-authentication/90742/1 "2024-05-22T15:07:32Z")
With SSO being disabled, what is the most secure authentication that Ignition supports now? ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [May 22, 2024, 3:26pm UTC](https://forum.inductiveautomation.com/t/most-secure-authentication/90742/2 "2024-05-22T15:26:13Z")
The most secure authentication is to use an IdP with two factors, with gateway SSL enabled and force-redirect turned on. SSO, when enabled, has always been the **least** secure authentication method. Your question implies the opposite, which is simply bogus, because it **assumes** that the person who logged into the OS at a computer is the same person accessing Ignition. SSO is a low-security **crutch** offered to placate personnel who would demand no authentication at all if they could. ---
**Author:** ![Jason\_Crockett](https://avatars.discourse-cdn.com/v4/letter/j/e99b99/32.png) [@Jason\_Crockett](https://forum.inductiveautomation.com/u/Jason_Crockett)\ **Post date:** [May 22, 2024, 3:54pm UTC](https://forum.inductiveautomation.com/t/most-secure-authentication/90742/3 "2024-05-22T15:54:28Z")
Thank you for the reply! I am sure there is a doc for this setup but all I find are only for SSO/MFA setup. Can you provide a step by step or some direction? I have Duo setup to authenticate with Entra ID and the gateway does have a SSL. That was solely due to only finding that type of document. Any direction would be appreciated. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [May 22, 2024, 4:02pm UTC](https://forum.inductiveautomation.com/t/most-secure-authentication/90742/4 "2024-05-22T16:02:51Z")
It's all here in the documentation: > **[Configuring Identity Providers | Ignition User Manual](https://www.docs.inductiveautomation.com/docs/8.1/platform/security/identity-provider-authentication-strategy/configuring-identity-providers)** > > Registering the Ignition Gateway Note that Ignition does NOT provide a native IdP with multi-factor authentication. It _supports_ using OpenID or SAML _external_ Identity Providers that have that functionality. ---
**Author:** ![Jason\_Crockett](https://avatars.discourse-cdn.com/v4/letter/j/e99b99/32.png) [@Jason\_Crockett](https://forum.inductiveautomation.com/u/Jason_Crockett)\ **Post date:** [May 22, 2024, 10:33pm UTC](https://forum.inductiveautomation.com/t/most-secure-authentication/90742/5 "2024-05-22T22:33:43Z")
I have been working on this most of the day. I have tried OpenID and SAML using Duo. I have been unsuccessful. Can I get more help on how to setup using an IdP with two factors? ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [May 22, 2024, 11:33pm UTC](https://forum.inductiveautomation.com/t/most-secure-authentication/90742/6 "2024-05-22T23:33:01Z")
I haven't had to do this myself. Have you opened a support ticket? (This forum is not support.) ---
**Author:** ![Jason\_Crockett](https://avatars.discourse-cdn.com/v4/letter/j/e99b99/32.png) [@Jason\_Crockett](https://forum.inductiveautomation.com/u/Jason_Crockett)\ **Post date:** [May 22, 2024, 11:49pm UTC](https://forum.inductiveautomation.com/t/most-secure-authentication/90742/7 "2024-05-22T23:49:53Z")
Yes, I do have a ticket open and have been chatting with them as well. ---
**Author:** ![Gregory\_Pierce](https://avatars.discourse-cdn.com/v4/letter/g/f17d59/32.png) [@Gregory\_Pierce](https://forum.inductiveautomation.com/u/Gregory_Pierce)\ **Post date:** [January 20, 2025, 10:02pm UTC](https://forum.inductiveautomation.com/t/most-secure-authentication/90742/8 "2025-01-20T22:02:26Z")
Just wondering if you had any luck with this? I'm trying the same thing to no avail at this point.