User-Managed Methods in the User Access Gateway¶

Fudo Enterprise lets you decide which authentication methods a User Access Gateway user is allowed to add or remove on their own. This way you can limit self-service enrollment to the methods approved by your security policy, instead of relying on user training.

Note

The setting is global - it applies to every User Access Gateway user.

Important

All methods are disabled by default. Until you enable a method here, User Access Gateway users cannot add or remove it themselves. Existing authentication methods are not affected - they remain on the list and can still be used to log in.

Selecting User-Managed Methods

Select Settings > Authentication.
Go to the Global tab and find the User-managed methods in User Access Gateway section.
Select the methods that User Access Gateway users are allowed to add and remove on their own:
- Password
- SSH key
- OATH
- Passkey

Click Save.

What the Setting Affects¶

Each checkbox governs both adding and removing the given method type in the User Access Gateway.

Action in the User Access Gateway	Method selected	Method not selected
Adding a new method	Allowed	Blocked - the button is greyed out
Removing an existing method	Allowed	Blocked - the button is greyed out
Editing an existing method (for example, changing a password)	Allowed	Allowed
Logging in with an existing method	Allowed	Allowed

Note

Clearing a checkbox never removes methods that users already have. It freezes the set of methods a user holds: no new method of that type can be added, and no existing one can be removed by the user. To remove such a method, an administrator has to do it in the Admin Panel - see Creating a User.

Note

Changing an existing password in the User Access Gateway is an edit, not an addition, so it remains available even when Password is not selected. This also applies to password changes enforced by the password complexity policy.

Passkey and FIDO2 Configuration¶

The Passkey checkbox only decides whether users may enroll passkeys themselves. Before a passkey can be created at all, FIDO2 has to be configured by an administrator - see FIDO2 Authentication Settings.

Note

If FIDO2 is not configured, the + Passkey button is not shown in the User Access Gateway at all, even when the Passkey checkbox is selected. For the same reason, the Login with Passkey button on the login page is displayed only when FIDO2 is configured for the given interface.

Related topics: