---
alias: operation-guide-security-portal-strategies-index
description: "Security Portal uses authentication strategies to connect with identity management systems securely."
---

# Strategies

Strategies are the way the Security Portal authenticates a user. Each strategy connects the Security Portal to one identity management system, where the user credentials and security information are stored.

A tenant can have several strategies configured at the same time, so users can authenticate against more than one source without complex configuration. For how strategies fit into the overall sign-in flow, see [How the Security Portal Works](../security_portal_howdoesitwork.md#authentication-sources-and-strategies).

## Supported Strategies

| **Strategy**                                                 | **Type**                        | **Plugin**                                         | **Out of the Box** |
|--------------------------------------------------------------|---------------------------------|----------------------------------------------------|--------------------|
| [[operation-guide-security-portal-strategy-openidconnect]]   | `open-id-connect`               | `@criticalmanufacturing/auth-plugin-openidconnect` | Yes                |
| [[operation-guide-security-portal-strategy-activedirectory]] | `local-ActiveDirectory`         | `@criticalmanufacturing/auth-plugin-local`         | Yes                |
| [[operation-guide-security-portal-strategy-local]]           | `local-CoreDatabase`            | `@criticalmanufacturing/auth-plugin-local`         | Yes                |
| [[operation-guide-security-portal-strategy-ldap]]            | `local-LDAP`                    | `@criticalmanufacturing/auth-plugin-local`         | No                 |
| [[operation-guide-security-portal-strategy-barcode]]         | `local-barcode`                 | `@criticalmanufacturing/auth-plugin-local`         | No                 |
| [[operation-guide-security-portal-strategy-webauthn]]        | `local-WebAuthn`                | `@criticalmanufacturing/auth-plugin-local`         | Yes                |
| [[operation-guide-security-portal-strategy-oauth2]]          | `oauth2-AuthorizationGrantFlow` | `@criticalmanufacturing/auth-plugin-oauth2`        | No                 |

Table: Supported strategies

Microsoft Entra ID has no dedicated strategy: it signs users in through the OpenID Connect strategy. For the setup, see [[operation-guide-security-portal-strategy-azuread]].

The strategies available out of the box are created by the installation, and you enable and configure them in DevOps Center. The other strategies, and any additional strategy of the same type, are added through a customization package. For more information, see [Deployment via CmfEntrypoint](https://developer.criticalmanufacturing.com/explore/guides/customizations/securityportal/configuration/#deployment-via-cmfentrypoint) in the Developer Portal.

Each strategy page describes its parameters. For how to add a strategy to a tenant, the properties common to all strategies, and the database connection used by the local strategies, see [Authentication Strategies](../security-portal-configuration/security_portal_config_securityportal.md#authentication-strategies).

## Two-Factor Authentication

The Security Portal supports the following two-factor authentication mechanisms:

* Static PIN
* [TOTP](https://datatracker.ietf.org/doc/html/rfc6238) code

## Custom Strategies

If none of the provided strategies fits your identity management system, you can add a custom strategy to the Security Portal. To implement one, see [Authentication Strategies](https://developer.criticalmanufacturing.com/explore/guides/customizations/securityportal/strategies/) in the Developer Portal.

## Further Reading

* [OAuth 2.0 Authorization Framework (RFC 6749)](https://datatracker.ietf.org/doc/html/rfc6749)
* [Authorization Code Flow with Proof Key for Code Exchange (PKCE)](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow-with-pkce)
* [JSON Web Tokens](https://www.jwt.io/)