IVS Wiki:User Management
VALT Authentication Methods – Feature Overview
VALT supports three authentication types:
- Local Accounts
- Active Directory (AD/LDAP)
- SAML/Single Sign-On (SSO).
Below, we’ve broken down the key differences and considerations into categories like Management, Scalability, Reliability, and Security to help guide your decision.
Management & Admin Control
Ease of Setup (Initial Configuration)
Local: Easy to set up. Admins can create accounts directly in VALT with no external dependencies. AD / SSO: Requires IT involvement for initial configuration (e.g., networking, mappings, certificates).
Ease of Ongoing User Management
Local: Admins manage users, passwords, and groups within VALT. Great for hands-on control but becomes tedious at scale. AD / SSO: User updates are handled in external systems. Changes are centralized but require coordination with IT.
Group Management Within VALT
Local: Full manual control—admins can create groups and assign users directly. AD / SSO: Group membership is controlled externally. VALT reads and enforces group assignments from AD or the SSO provider.
Test Account Creation
Local: Admins can create test users easily for troubleshooting or permission checks. AD / SSO: Test accounts require setup in the external system (or can't exist without real credentials), making this harder.
Scalability & Flexibility
Scalability for Larger Orgs
Local: Not scalable. Every account must be added and maintained manually. AD / SSO: Designed to scale. Easily supports hundreds or thousands of users by syncing existing data from your org’s directory.
Use of Existing Org Logins
Local: Requires unique credentials for VALT. AD / SSO: Reuses org credentials, reducing password fatigue and support tickets.
Custom Attributes & Extended Info
AD / SSO: Can pull in extra user info (e.g., department, title) from the directory for reporting or automation. Local: Limited to basic user info.
Security & Access Control
Password Management
Local: Admins reset passwords manually. AD / SSO: Passwords are managed externally; changes apply instantly to VALT access.
Just-in-Time Provisioning (SSO only)
SSO: VALT creates the user account upon first login based on info provided by the Identity Provider. Admins don’t need to pre-create users.
Access Deactivation
AD / SSO: Disable access centrally by removing the user from the appropriate group—no need to log into VALT. Local: Must manually delete or deactivate the user in VALT.
Reliability & Dependencies
Reliance on External Systems
Local: Independent. VALT access continues even if external systems (AD or SSO) are down. AD / SSO: VALT access depends on the availability of external authentication systems.
Network Requirements
AD: Requires specific firewall rules and network connectivity to the LDAP server. SSO: No special network setup needed—authentication happens in the browser.
SSO Requirements
SSO: Needs SSL certificates and accurate time-syncing (NTP). These are standard in most enterprise environments.
