> For the complete documentation index, see [llms.txt](https://docs.securepass.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.securepass.me/documentation/reference/authentication-and-mfa-methods.md).

# Authentication and MFA methods

Authentication proves who someone is. Authorisation decides what they may do. They are separate questions, answered by separate parts of the platform — this page covers the first.

SECUREpass ships a broad set of authentication modes, and you combine them per application and per risk level. The modes available to your organisation are the ones an administrator has enabled under **Configuration → Authentication Modes**.

## Primary, secondary and tertiary factors

Each application requires a **primary** mode — the first factor, usually a password, though it can be a passwordless factor instead — and may require **secondary** and **tertiary** modes layered on top for stronger assurance.

Modes are mapped to strength levels, so a higher-risk application can demand a stronger combination than a low-risk one. The requirement is configured per application, and can be tied to a risk profile so that it adapts to context rather than staying fixed. That is adaptive authentication.

## The method catalogue

| Mode                 | What the user presents                                                  | Assurance |
| -------------------- | ----------------------------------------------------------------------- | --------- |
| Password             | A username and password                                                 | Medium    |
| SMS OTP              | A one-time code sent to the registered mobile number                    | Basic     |
| Email OTP            | A one-time code sent to the registered email address                    | Basic     |
| GRID                 | A response to a coordinate challenge from a personal GRID card          | Medium    |
| KBA                  | Answers to predefined personal questions                                | Basic     |
| FingerPrint          | Registered fingerprint biometrics, on any device that supports them     | Medium    |
| HTOK                 | A code from a physical hardware token device                            | Medium    |
| DSC                  | A digital signature certificate held on a device or token               | High      |
| Mobile PKI           | A signature produced by a certificate held in the SECUREpass mobile app | Medium    |
| Face Recognition     | A live facial scan with a blink liveness check                          | Medium    |
| PushNotification     | An approve-or-deny prompt with number matching                          | Medium    |
| Authenticator (TOTP) | A time-based code from an authenticator app                             | Medium    |
| QR code              | A code scanned from the sign-in page                                    | Medium    |
| Kerberos             | A domain credential, verified by the KDC                                | Medium    |
| Office365            | Microsoft 365 credentials, verified against the Microsoft directory     | Medium    |

Each mode carries an **assurance level** — Basic, Medium or High — which is what the per-application and risk-profile rules compare against when deciding whether a combination is strong enough.

### Single sign-on and federation

Separately from the modes above, applications integrate with SECUREpass over **SAML 2.0**, **OpenID Connect** and **OAuth 2.0**, with **RADIUS** for network devices and VPN concentrators, and **header-based** and **NTLM** for agentless desktop sign-on. These are how an application hands authentication to SECUREpass — not factors a user presents.

OTP methods follow the standard algorithms — TOTP per RFC 6238 and HOTP per RFC 4226 — with configurable code length, expiry and retry count.

## How a method is put into use

The pattern is the same regardless of which method:

1. **Enable it for the tenant** and configure its parameters — OTP length and expiry, the gateway it sends through, biometric settings.
2. **Add it to the required modes** of the applications or risk profiles that should demand it.
3. **Have users enrol.** A method that is required but not enrolled will block sign-in, so give people the enrolment window before you enforce it.

## The SECUREpass Authenticator

One mobile app, on Android and iOS, covering several modes at once: Authenticator (TOTP), PushNotification, GRID and QR code. It carries a dashboard with quick resource access and the user's own activity log.

Registration is: enter the registered email or username, verify with an OTP sent to the registered mobile or email address, then set an in-app first factor — a PIN, fingerprint or facial scan.

## Choosing between methods

Phishing resistance is the distinction that matters most. Certificate-based methods — DSC and Mobile PKI — and push-with-number-matching resist an attacker who has the password and can talk to the user; SMS OTP and email OTP do not.

Convenience matters too, and pushing people onto a method they find awkward produces workarounds. In practice most organisations enable several, require a strong one for administrative and privileged access, and allow a weaker fallback elsewhere.