Authentication

RelativityOne supports the following authentication mechanisms.

• Password—a method that includes a user name, the user's email address, and a password.
• OpenID Connect—a protocol for an external identity provider, authenticating against an external identity provider using the OpenID Connect protocol. OpenID Connect is a modern authentication protocol can be used to connect to providers such as Microsoft Entra ID. See OpenID Connect for more information.
• SAML 2.0—a method that authenticates against an external identity provider using the SAML 2.0 protocol. SAML 2.0 is an older authentication protocol that is still in widespread use. See SAML 2.0 for more information.

In addition to the above protocols, Relativity has the following additional authentication features:

• Two-factor Authentication—when logging in with the Password method, you can require the user to pass an additional two-factor check based on an email or message sent to the user's phone, through a mobile email gateway.
  • Mode—always required or require only for non-trusted IPs
  • Method—Authenticator App or email. For more information, see the authenticator app's documentation.
  
• Trusted IP Range—limit access to the Relativity application based on the user's source IP address.

Relativity provides several tabs or object types that are used to configure authentication. By combining these object types, the system admin is able to control the Relativity login page and authentication options for the users in the environment.

Authentication Provider—an authentication provider holds the settings for one login protocol. For example, you can add the Password Provider to your environment to set minimum and maximum password length, password history settings, and more. Some protocols have several configuration options, and others have very few. In legacy authentication, every instance has a Default Password provider, and you cannot add a second provider of that type.

You can add OpenID Connect and SAML 2.0 external identity providers. You can have more than one provider of either type in an environment.

Login Method - Users can have one or more Login method objects that binds that user to a particular Authentication Provider. For example, if you have a Password Authentication Provider in the environment, the Password Login Method contains the specific password for a given user. If you have Azure Active Directory configured as a Provider, each user's AAD subject identifier would be stored in an associated Login method.

User—in legacy authentication, the User object holds the TrustedIPs setting. When you set a TrustedIP for a user, that user can authenticate with RelativityOne only from that IP range. All other authentication-related fields sit on the Provider and Method objects.

These default object permissions are recommended for managing user authentication:

• System admins only—full permissions, including view, update, delete, secure, add
• Authentication Provider Type
• Authentication Provider
• Login Method
• OAuth2 Clients
• Anyone with the ability to view a user—view
• Authentication Provider Type
• Authentication Provider
• Login Method
• Anyone with the ability to edit a user—update, delete, add
• Login Method

Authentication providers are instances of authentication provider types. You create only the instances of the provider types you need. For example, if you plan to support only password methods, you only have to create an authentication provider for passwords, and not for any other provider types.

In legacy authentication, you can have only one instance of each provider type. OpenID Connect and SAML 2.0 are the exceptions. You can have more than one instance of those types if each one has a different name.

To create an Authentication Provider:

1. Select the Authentication Provider tab.
2. Click the New Authentication Provider button.
3. Enter a Name. This is the friendly name of the provider instance.
4. Optionally select the Enabled status. By default, each authentication provider is enabled. If the provider is not enabled, users cannot log in with that method.
5. Select a Provider Type. In legacy authentication, you can select OpenID Connect or SAML2.
   The Authentication Provider Settings section appears.
6. Set the Authentication Provider Settings, if any. See Authentication provider settings for the specific method.
7. Click Save.

You assign an authentication method to each user for them to log in with. Each user must have at least one authentication method in order for them to log in but you may assign multiple methods. See Managing user authentication methods.