> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usetero.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication and Password Standard

> Authentication, password, MFA, and session-control baseline for user access.

export const securityEmail = "security@usetero.com";

<Badge>Last reviewed: March 5, 2026</Badge>
<Badge>Owner: Security + Engineering</Badge>
<Badge>Review cadence: Quarterly</Badge>
<Badge color="green">Status: Implemented</Badge>

This standard defines how Tero enforces user authentication controls, including password policy ownership, MFA, and session protections.

## What this standard answers

* Who owns password policy controls in hosted and self-hosted deployments
* How authentication is enforced for users and admins
* What controls are applied when password-based authentication is used

## Implementation status (March 5, 2026)

Tero supports SSO and OIDC-capable authentication and enforces authentication and session controls in application access paths.

## Authentication and password baseline

| Area                                  | Requirement                                                                                         |
| ------------------------------------- | --------------------------------------------------------------------------------------------------- |
| Primary user authentication model     | SSO-capable authentication with SAML 2.0 and OpenID Connect support                                 |
| Password policy source of truth (SSO) | Customer IdP policy controls (complexity, lockout, rotation, MFA policies)                          |
| Password handling                     | Tero never stores passwords in source code; managed identity systems handle password authentication |
| MFA support                           | Enforced through customer IdP policy where configured                                               |
| Administrative access                 | Restricted administrative access model with scoped authorization                                    |
| Session controls                      | Tero enforces session validation and scoped authorization in runtime access paths                   |

## Supported login and SSO protocols

| Method or protocol                | Support                              | Notes                                                                               |
| --------------------------------- | ------------------------------------ | ----------------------------------------------------------------------------------- |
| Username and password             | Supported                            | Can be disabled when SSO-only access is required                                    |
| SSO via SAML 2.0                  | Supported                            | Works with major SAML-compatible IdPs                                               |
| SSO via OpenID Connect            | Supported                            | Works with major OIDC-compatible IdPs                                               |
| Multi-factor authentication (MFA) | Supported                            | Enforced through customer IdP policy for SSO; configurable for password-based login |
| OAuth 2.0 delegated access        | Supported                            | Used for scoped API/integration authorization paths                                 |
| LDAP                              | Not a direct authentication protocol | LDAP-backed directories integrate through IdP/SSO providers                         |

## Automated provisioning and deprovisioning

| Capability                 | Support model              | Notes                                                                                                                                           |
| -------------------------- | -------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
| User provisioning          | Supported                  | Customer IdP directory-sync integrations create users                                                                                           |
| User deprovisioning        | Supported                  | Removing or disabling a user in the customer IdP removes the user or revokes their access                                                       |
| Inactive-account handling  | Supported                  | Customer IdP lifecycle policy, platform account-lifecycle controls, or both disable inactive user access, depending on deployment configuration |
| Group-based access mapping | Supported                  | IdP groups can be mapped to product roles/teams for least-privilege access assignment                                                           |
| SCIM transport             | Supported where configured | SCIM-capable directory-sync paths are supported through identity integrations; provider-native sync paths are also supported                    |

## Session timeout and reauthentication settings

| Access mode       | Default session/reauth behavior                                                    | Customer configurability                                                                                                   |
| ----------------- | ---------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- |
| SSO (SAML/OIDC)   | Session timeout and reauthentication follow customer IdP policy defaults           | Customer-configurable in IdP policy (for example idle timeout, max session age, reauth/MFA frequency)                      |
| Username/password | Tero enforces platform-managed secure session controls in application access paths | Customers can require SSO-only mode; Tero reviews customer-specific session policy requirements during security onboarding |

## Session binding and network attribute controls

| Control                               | Baseline behavior                                                        | Customer configurability                                  |
| ------------------------------------- | ------------------------------------------------------------------------ | --------------------------------------------------------- |
| Device-aware session policy           | Enforced through customer IdP/conditional-access policy where configured | Configurable by customer in IdP/device-trust policy       |
| Network/IP-based session restrictions | Supported through customer IdP policy and network allowlisting controls  | Configurable by customer requirement and deployment model |

## Enforcement model

* Tero requires authentication before access to protected application paths.
* Tero evaluates authorization in tenant and workspace context.
* Tero removes or adjusts access when role and lifecycle state changes.

## Hosted vs self-hosted scope

| Area                                 | Tero-hosted         | Self-hosted                                  |
| ------------------------------------ | ------------------- | -------------------------------------------- |
| Application authentication controls  | Tero-operated       | Tero software with customer runtime controls |
| IdP password and MFA policy settings | Customer-controlled | Customer-controlled                          |
| Runtime identity stack operations    | Tero-operated       | Customer-operated runtime                    |

## Exceptions and governance

Any authentication or password-control exception requires documented risk acceptance, approval, compensating controls, and a time-bound remediation plan.

Questions: [{securityEmail}](mailto:\{securityEmail})