Identity: passkeys, SSO and directory

How people prove who they are: passkeys for everyone, single sign-on for your own staff, group mapping from your directory, and the mail server that carries invitations.

Passkeys and recovery

There are no passwords anywhere in Captivo Access. Every account, admin or vendor, signs in with a passkey (WebAuthn): Touch ID, Windows Hello, a phone, or a hardware security key. The secret never leaves the device, so there is nothing to phish, reuse or share in a chat message.

A user can register more than one passkey. Ask people to add a second device right after enrolling; a lost laptop then costs a passkey, not an account.
TOTP recovery is the break-glass path for someone who has lost every passkey: a one-time code from an authenticator app lets them in once, to register a new passkey. It is recovery, not a second way to sign in day to day.
Enrollment and sign-in problems, including the self-hosted RP ID mismatch, are in cannot sign in with a passkey.

Signing in with SSO / OIDC

Under Infrastructure → Single sign-on you can connect an OpenID Connect provider such as Microsoft Entra ID, Google Workspace or Okta. Your own staff and admins may then sign in through it instead of, or alongside, a passkey.

Accounts are invite-matched, never auto-provisioned: a person who signs in through your provider is let in only if an account with that e-mail already exists here. Vendors stay passkey-only; SSO is for people who already live in your directory.

Active Directory / LDAP and group mapping

Under Infrastructure → Directory you connect an Active Directory or LDAP server. The directory is reached through a connector, exactly like an internal app, so it needs no exposure to the internet; the bind is tested from the console before anything is saved.

Then map directory groups, by their DN, to either a console role or a specific resource. Membership drives authorisation from that point on: add someone to the group and they receive the mapped access; remove them in your directory and the mapped access goes with it, without anyone touching a grant here.

Email (SMTP)

Under Infrastructure → Email enter your SMTP host, port and credentials, tick Enabled, and send a test message. Once it works, the console mails invitations, access-request and approval notices, and resource down / recovered alerts.

Nothing depends on it, though. An invitation can always be copied as a one-time link and sent by whatever channel you prefer, and every one of those events also raises a notification in the console bell whether or not a mail server is configured.