> For the complete documentation index, see [llms.txt](https://cleyrop.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cleyrop.gitbook.io/docs/documentation-fr-en/administration/gerer-la-securite-des-comptes.md).

# Manage account security

As Platform Manager, you can configure the Cleyrop platform security settings via the Security page.

It is accessible from **Administration > Security** and covers three areas: session policy, password policy, and identity federation (SSO).

<figure><img src="/files/134862810fe116054f7d71e5c5af817aa2726238" alt=""><figcaption></figcaption></figure>

***

## Identity federation (SSO)

Identity federation allows your users to log in to Cleyrop with their corporate credentials, via your existing identity provider (IdP) (Azure AD, Okta, ADFS, etc.).

When enabled, Cleyrop accounts are automatically created at first login and user attributes are synchronized at each login.

### Login mode

Choose how your users will be able to log in to Cleyrop:

* **IdP or Cleyrop credentials** *(recommended during the setup phase)* — users can log in via their IdP or with their Cleyrop credentials.
* **IdP only** — the Cleyrop login form is disabled, only the IdP is allowed.

### IdP connection configuration

Enter the connection information for your IdP:

* **Discovery URL (Discovery Endpoint)** : URL `.well-known/openid-configuration` provided by your IdP. Example: `https://login.microsoftonline.com/{tenant}/.well-known/openid-configuration`
* **Client ID** : identifier of the application registered in your IdP.
* **Client Secret** : secret key associated with the application in your IdP.

Use the button **Test connection** to validate that the settings are correct before enabling federation.

### Attribute mapping

Specify the names of the claims returned by your IdP to map them to Cleyrop fields:

| Cleyrop field | Current IdP claim    | Required                           |
| ------------- | -------------------- | ---------------------------------- |
| Name          | `family_name`        | Yes                                |
| First name    | `given_name`         | Yes                                |
| Email         | `email`              | Yes                                |
| Username      | `preferred_username` | No (email is used if not provided) |

### Assignment of Cleyrop profiles

Map your IdP groups or roles to Cleyrop profiles. Enter the name of the claim containing the group (e.g. `groups`, `roles`, `memberOf`), then define the mappings:

| IdP group value   | Cleyrop profile  |
| ----------------- | ---------------- |
| Ex: DataEngineers | Data Worker      |
| Ex: Admins        | Platform Manager |

#### Activation

Click **Enable federation** to complete the configuration. You will be asked for confirmation before activation.

Once enabled, you can **Edit the configuration** or **Disable federation** at any time.

## Inactivity management

You can configure the automatic deactivation of inactive accounts. Available options are: 30 days, 60 days, 90 days or 180 days without login.

## Session duration policy management

Define inactivity and maximum session durations for your users. The new values will apply to upcoming sessions; they will not affect active sessions.

| Parameter                             | Available options           | Default value |
| ------------------------------------- | --------------------------- | ------------- |
| Automatic logout after inactivity     | 15 min · 30 min · 60 min    | 30 min        |
| Maximum session duration              | 4 h · 8 h · 10 h            | 8 h           |
| Offline token expiration (inactivity) | 7 days · 14 days · 30 days  | 14 days       |
| Maximum offline token lifetime        | 30 days · 45 days · 60 days | 30 days       |

Click **Save changes** to apply the changes. You can also **Restore default values** at any time.

{% hint style="info" %}
The maximum limit on offline sessions is permanently enabled on the platform for security reasons (ANSSI compliance).
{% endhint %}

## Password policy management

Define password complexity rules for your users. The new rules will apply to the next password changes; existing passwords are not retroactively invalidated.

| Parameter                            | Allowed range | Default value |
| ------------------------------------ | ------------- | ------------- |
| Minimum number of characters         | 12 to 32      | 12            |
| Minimum number of uppercase letters  | 0 to 5        | 1             |
| Minimum number of lowercase letters  | 0 to 5        | 1             |
| Minimum number of digits             | 0 to 5        | 1             |
| Minimum number of special characters | 0 to 5        | 1             |

Click **Save changes** to apply the changes. You can also **Restore default values** at any time.

{% hint style="info" %}
The minimum length cannot be less than 12 characters (ANSSI compliance requirement).
{% endhint %}

***

### Best practices

* Start in mode **IdP or Cleyrop credentials** to ease the transition before switching to IdP-only mode.
* Test the IdP connection before activation to avoid blocking users.
* Make sure all IdP groups are mapped before activation — any unmapped group will result in a login rejection.
* Keep at least one Platform Manager account with Cleyrop credentials during the SSO setup phase.