Authentication

Authentication decides how people reach your self-hosted TestOps instance and how sign-in fits into your existing identity landscape. The next step is to choose the provider model and then connect it to TestOps access behavior.

Choose the authentication method

• Local authentication
• LDAP
• OpenID Connect
  • Azure AD OpenID example
  • Keycloak OpenID example
• SAML2
  • Generic SAML 2.0 explanation
  • Okta SAML 2.0 example

After sign-in works

• Use Users and access for instance roles and permissions.

Keep a local recovery path

If your main sign-in flow uses LDAP, OpenID, or SAML, keep the built-in system login reachable for recovery scenarios. The local login is the path to use when:

• the external identity provider is unavailable or misconfigured;
• you need to enter a new license after expiration;
• the only remaining administrator must sign in outside the external IAM flow.

Use <your TestOps URL>/login/system to open the built-in account login page. For the local-account workflow itself, see Local authentication.