> For the complete documentation index, see [llms.txt](https://cleyrop.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cleyrop.gitbook.io/docs/v4.7-en/administration/gerer-la-securite-des-comptes.md).
# Manage account security
Configure the security rules of your Cleyrop environment: session policy, password requirements, and sign-in through your company identity provider.
As a Platform Manager, you can configure the Cleyrop platform security settings via the Security page.
It is accessible from **Administration > Security** and covers three areas: session policy, password policy, and identity federation (SSO).
***
## Identity federation (SSO)
Identity federation allows your users to sign in to Cleyrop with their corporate credentials, via your existing identity provider (IdP) (Azure AD, Okta, ADFS, etc.).
When enabled, Cleyrop accounts are created automatically at first sign-in and user attributes are synchronized at each sign-in.
### Login mode
Choose how your users will be able to sign in to Cleyrop:
* **IdP or Cleyrop credentials** *(recommended during the setup phase)* — users can sign in via their IdP or with their Cleyrop credentials.
* **IdP only** — the Cleyrop login form is disabled, only the IdP is allowed.
### IdP login configuration
Enter the login information for your IdP:
* **Discovery URL (Discovery Endpoint)** : URL `.well-known/openid-configuration` provided by your IdP. Example: `https://login.microsoftonline.com/{tenant}/.well-known/openid-configuration`
* **Client ID** : identifier of the application registered in your IdP.
* **Client Secret** : secret key associated with the application in your IdP.
Use the **Test connection** button to validate that the settings are correct before enabling federation.
### Attribute mapping
Specify the names of the claims returned by your IdP to map them to Cleyrop fields:
| Cleyrop field | Current IdP claim | Required |
| ------------- | -------------------- | ---------------------------------- |
| Name | `family_name` | Yes |
| First name | `given_name` | Yes |
| Email | `email` | Yes |
| Username | `preferred_username` | No (email is used if not provided) |
### Assignment of Cleyrop profiles
Associate the groups or roles from your IdP with Cleyrop profiles. Enter the name of the claim containing the group (e.g. `groups`, `roles`, `memberOf`), then define the mappings:
The option **Included in the scope** (enabled by default) adds the name of this claim to the OAuth scope parameter requested from your IdP. Disable it if your provider returns groups or roles without them being requested in the scope: this is the case for **Microsoft Entra ID**, whose roles are automatically added to the token and cannot be requested via a scope.
| IdP group value | Cleyrop profile |
| ---------------------- | ---------------- |
| Example: DataEngineers | Data Worker |
| Example: Admins | Platform Manager |
#### Activation
Click on **Enable federation** to complete the configuration. You will be asked to confirm before activation.
Once enabled, you can **Edit the configuration** or **Disable federation** at any time.
## Inactivity management
You can configure the automatic deactivation of inactive accounts. Available options are: 30 days, 60 days, 90 days, or 180 days without sign-in.
## Session duration policy management
Define inactivity and maximum session durations for your users. The new values will apply to upcoming sessions; they will not affect active sessions.
| Setting | Available options | Default value |
| ------------------------------------- | --------------------------- | ------------- |
| Automatic logout after inactivity | 15 min · 30 min · 60 min | 30 min |
| Maximum session duration | 4 h · 8 h · 10 h | 8 h |
| Offline token expiration (inactivity) | 7 days · 14 days · 30 days | 14 days |
| Maximum offline token duration | 30 days · 45 days · 60 days | 30 days |
Click on **Save changes** to apply the changes. You can also **Restore default values** at any time.
{% hint style="info" %}
The maximum limit for offline sessions is permanently enabled on the platform for security reasons (ANSSI compliance).
{% endhint %}
## Password policy management
Define password complexity rules for your users. The new rules will apply to the next password changes; existing passwords are not invalidated retroactively.
| Setting | Allowed range | Default value |
| ------------------------------------ | ------------- | ------------- |
| Minimum number of characters | 12 to 32 | 12 |
| Minimum number of uppercase letters | 0 to 5 | 1 |
| Minimum number of lowercase letters | 0 to 5 | 1 |
| Minimum number of digits | 0 to 5 | 1 |
| Minimum number of special characters | 0 to 5 | 1 |
Click on **Save changes** to apply the changes. You can also **Restore default values** at any time.
{% hint style="info" %}
The minimum length cannot be less than 12 characters (ANSSI compliance requirement).
{% endhint %}
***
### Best practices
* Start in **IdP or Cleyrop credentials** to ease the transition before switching to IdP-only mode.
* Test the IdP connection before activation to avoid blocking users.
* Make sure all IdP groups are mapped before activation — any unmapped group will cause a login refusal.
* Keep at least one Platform Manager account with Cleyrop credentials during the SSO setup phase.
