Skip to content

Local Login Fallback When SSO Is Enabled

When single sign-on (SSO) is enabled, Portal's login page normally sends every visitor to your identity provider (IdP) and turns off local username/password login. That is the behavior you want day to day, but it creates a lockout risk: if the SSO configuration is wrong or your IdP is unavailable, admins can be left with no way to sign in and fix it.

Portal 1.20.0 adds an always-on local login option so a local admin can always reach a username/password login form, even while SSO is enabled. Use it to keep admin access in two situations:

  • SSO misconfiguration recovery - sign in locally to correct a broken SAML configuration.
  • Identity-provider outage continuity - keep admin access while the IdP is down.

Warning

Leave this option off unless you need it. It exists only to keep a small number of trusted admin accounts able to sign in when SSO is unavailable. All normal users should continue to authenticate through your identity provider.

Enable the local login fallback

Enable the fallback for your Portal in the Admin console:

  1. Sign in as an admin and go to Admin > Authentication.
  2. Select Enable local admin login.
  3. Save.

When the option is off (the default), enabling SSO fully disables local login and every visitor is redirected to the identity provider.

Who can use the fallback

The fallback is deliberately narrow: only existing local admin accounts can use it. Accounts provisioned through SSO, and non-admin local accounts, cannot sign in through the fallback - they continue to authenticate through the identity provider. There is no separate per-user setting to switch on; being a local admin account is what makes an account eligible.

In practice this means you should keep one or two dedicated local admin accounts for emergency access.

Sign in with the fallback

With the option enabled, browse directly to your Portal's admin URL — for example https://your-portal.example.com/zadmin — and Portal presents the local-admin login form there instead of redirecting to the identity provider. Sign in with a local admin's username and password to regain access, then correct the SSO configuration.

Security guidance

Because these accounts bypass SSO, treat them as privileged emergency-access credentials:

  • Keep the list tiny. Maintain only the minimum number of local admin accounts needed.
  • Use strong, unique passwords and store them securely (for example in a password vault), separate from day-to-day credentials.
  • Review and rotate the accounts and passwords periodically, and whenever someone with access leaves.
  • Turn the option back off once you no longer need it.