Two types of account
In LockPass, each user has either a standard account or an SSO account. The account type determines the login flow.
Standard account
- Access is managed by LockSelf.
- Login: email address, then two-factor authentication (MFA) code if configured, then master password (or passkey).
- Badge shown in the user list: "Local".
SSO account
- Access is managed by your organization's identity provider (IdP): Microsoft Entra ID, Okta…
- Login: email address, then authentication with your IdP, then master password (or passkey).
- Badge shown in the user list: "SSO". An SSO account with local login enabled is shown as "SSO + Local".
The IdP does not replace the master password: it remains essential, because it is what decrypts your vault.
The login flow
To log in to LockPass:
- Enter your email address.
- LockPass routes you automatically based on your account type:
- SSO account: you are redirected to your IdP. If your IdP session is still active, this step is seamless; otherwise, the IdP asks you to authenticate.
- Standard account: enter your MFA code if two-factor authentication is configured.
- Enter your master password, or use your passkey if you have set one up.
- You are logged in.
- You do not choose your login method. Unlike v3, the login screen no longer offers a "Standard / SSO" choice, for security reasons.
- The flow is the same on the web app, the browser extension and the mobile app.
Session duration and login duration
LockPass distinguishes between two durations, which do not have the same effect when they expire:
Session duration
- Set by the administrator, or left to the user's choice.
- When it expires, the user only enters their master password (or uses their passkey).
Login duration
- Set by the administrator.
- When it expires, the user goes through the full login flow again (email, IdP or MFA, master password).
What about your IdP session?
The IdP session duration is set by your organization, in your IdP. It only comes into play when LockPass redirects the user to the IdP: if it is still active, the user does not need to authenticate with the IdP again.
No centralized logout
LockPass does not support centralized logout (Single Logout): your IdP cannot close a LockPass session that is already open. A user deactivated in your IdP keeps access to LockPass until their login duration expires. Adjust this duration to your security policy.
Controlling who can log in with SSO
LockPass does not query your directory: it only learns that a user exists in your IdP when that user attempts an SSO login. As soon as the IdP validates the authentication, the user is authorized to access LockPass.
It is therefore in your IdP that the directory administrator chooses who can log in with SSO, by assigning the LockSelf application to people or groups:
- Okta: a user who is not assigned to the application is denied (error 403).
- Microsoft Entra ID: an unassigned user is denied (error AADSTS50105) only if the "Assignment required" option is enabled on the application. Otherwise, anyone in your tenant, including guests, can log in.
When an SSO login fails
The error message is displayed on your IdP's page, not in LockPass. LockPass does not receive the reason for the failure (account missing from the directory, not assigned to the application, blocked…). To understand the error, note the message displayed by the IdP or check your IdP's sign-in logs.
Logging in without the IdP
If your IdP is unavailable or compromised, an administrator can enable the "Local login" option on an SSO user's profile. The IdP step is then skipped: the user logs in with their master password (or passkey).
- When enabled, local login takes precedence over SSO.
- This use is temporary: remember to disable the option after the incident, so that the user goes back through your IdP's rules.
For the detailed procedure, see the article Allow local login (SSO users).
Quick troubleshooting
- "A user can no longer log in with SSO": check that they are assigned to the LockSelf application in your IdP, and note the message displayed by the IdP.
- "An SSO user needs to log in without the IdP": enable the "Local login" option on their profile.
- "My users go back through the IdP every morning": check the login duration set in LockPass and the session duration set in your IdP.
Updated