Authentication and Password Standard

Last reviewed: March 5, 2026 Owner: Security + Engineering Review cadence: Quarterly Status: Implemented This standard defines how Tero enforces user authentication controls, including password policy ownership, MFA, and session protections.

What this standard answers

Who owns password policy controls in hosted and self-hosted deployments
How authentication is enforced for users and admins
What controls are applied when password-based authentication is used

Implementation status (March 5, 2026)

Tero supports SSO and OIDC-capable authentication and enforces authentication and session controls in application access paths.

Authentication and password baseline

Area	Requirement
Primary user authentication model	SSO-capable authentication with SAML 2.0 and OpenID Connect support
Password policy source of truth (SSO)	Customer IdP policy controls (complexity, lockout, rotation, MFA policies)
Password handling	Tero never stores passwords in source code; managed identity systems handle password authentication
MFA support	Enforced through customer IdP policy where configured
Administrative access	Restricted administrative access model with scoped authorization
Session controls	Tero enforces session validation and scoped authorization in runtime access paths

Method or protocol	Support	Notes
Username and password	Supported	Can be disabled when SSO-only access is required
SSO via SAML 2.0	Supported	Works with major SAML-compatible IdPs
SSO via OpenID Connect	Supported	Works with major OIDC-compatible IdPs
Multi-factor authentication (MFA)	Supported	Enforced through customer IdP policy for SSO; configurable for password-based login
OAuth 2.0 delegated access	Supported	Used for scoped API/integration authorization paths
LDAP	Not a direct authentication protocol	LDAP-backed directories integrate through IdP/SSO providers

Automated provisioning and deprovisioning

Capability	Support model	Notes
User provisioning	Supported	Customer IdP directory-sync integrations create users
User deprovisioning	Supported	Removing or disabling a user in the customer IdP removes the user or revokes their access
Inactive-account handling	Supported	Customer IdP lifecycle policy, platform account-lifecycle controls, or both disable inactive user access, depending on deployment configuration
Group-based access mapping	Supported	IdP groups can be mapped to product roles/teams for least-privilege access assignment
SCIM transport	Supported where configured	SCIM-capable directory-sync paths are supported through identity integrations; provider-native sync paths are also supported

Session timeout and reauthentication settings

Access mode	Default session/reauth behavior	Customer configurability
SSO (SAML/OIDC)	Session timeout and reauthentication follow customer IdP policy defaults	Customer-configurable in IdP policy (for example idle timeout, max session age, reauth/MFA frequency)
Username/password	Tero enforces platform-managed secure session controls in application access paths	Customers can require SSO-only mode; Tero reviews customer-specific session policy requirements during security onboarding

Session binding and network attribute controls

Control	Baseline behavior	Customer configurability
Device-aware session policy	Enforced through customer IdP/conditional-access policy where configured	Configurable by customer in IdP/device-trust policy
Network/IP-based session restrictions	Supported through customer IdP policy and network allowlisting controls	Configurable by customer requirement and deployment model

Enforcement model

Tero requires authentication before access to protected application paths.
Tero evaluates authorization in tenant and workspace context.
Tero removes or adjusts access when role and lifecycle state changes.

Hosted vs self-hosted scope

Area	Tero-hosted	Self-hosted
Application authentication controls	Tero-operated	Tero software with customer runtime controls
IdP password and MFA policy settings	Customer-controlled	Customer-controlled
Runtime identity stack operations	Tero-operated	Customer-operated runtime

Exceptions and governance

Any authentication or password-control exception requires documented risk acceptance, approval, compensating controls, and a time-bound remediation plan. Questions:

Overview

Foundations

Controls

Assurance

Policies

Authentication and Password Standard

What this standard answers

Implementation status (March 5, 2026)

Authentication and password baseline

Automated provisioning and deprovisioning

Session timeout and reauthentication settings

Session binding and network attribute controls

Enforcement model

Hosted vs self-hosted scope

Exceptions and governance

​What this standard answers

​Implementation status (March 5, 2026)

​Authentication and password baseline

​Supported login and SSO protocols

​Automated provisioning and deprovisioning

​Session timeout and reauthentication settings

​Session binding and network attribute controls

​Enforcement model

​Hosted vs self-hosted scope

​Exceptions and governance

What this standard answers

Implementation status (March 5, 2026)

Authentication and password baseline

Supported login and SSO protocols

Automated provisioning and deprovisioning

Session timeout and reauthentication settings

Session binding and network attribute controls

Enforcement model

Hosted vs self-hosted scope

Exceptions and governance