---
title: "Sign-in Methods"
description: "Sign-in to LumiScan Annotation Web with local accounts, Active Directory / LDAP or single sign-on with OpenID Connect (Keycloak, Microsoft Entra ID)."
product: "LumiScan Annotation Web"
component: "lumiscan-annotation-web"
version: "2.1.0"
display_version: "2.1.0.0"
latest_version: false
language: "en"
url: "https://docs.hdvisionsystems.com/en/lumiscan-annotation-web/2.1.0/sign-in-methods.html"
---

# Sign-in Methods – LumiScan Annotation Web

Everyone signs in; the name in the save history of every image is the signed-in user. Three methods can be combined. They and their secrets are configured only in the server’s configuration file (section `auth`), never in the browser.

![Sign-in card with the button Sign in with Company SSO, and the fields user name and password for the company account](https://docs.hdvisionsystems.com/en/lumiscan-annotation-web/2.1.0/_images/screens/login-card.png)

## Local accounts

`"local_login": true` (default). Admins create local accounts in the browser (see [Users and Roles](https://docs.hdvisionsystems.com/en/lumiscan-annotation-web/2.1.0/users-and-roles.html)). Passwords have at least 10 characters and are stored as PBKDF2-SHA256 hashes with 600 000 rounds.

> [!TIP]
> Keep at least one local administrator, also with the directory or single sign-on. It is your way in when the directory is not reachable.

## Active Directory / LDAP

The server searches the user with a read-only service account, checks the password with a sign-in as that user and reads the groups. Users sign in with the same name and password as on their work computer.

```json
"ldap": {
  "enabled": true,
  "label": "company account",
  "url": "ldaps://dc01.ad.example.com:636",
  "ca_file": "company-root-ca.pem",
  "bind_dn": "CN=ldap-bind,OU=Service Accounts,DC=ad,DC=example,DC=com",
  "bind_password_file": "ldap-bind.secret",
  "base_dn": "DC=ad,DC=example,DC=com",
  "user_filter": "(&(objectClass=user)(sAMAccountName={username})(!(userAccountControl:1.2.840.113556.1.4.803:=2)))",
  "group_attribute": "memberOf",
  "group_filter": "(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={dn}))"
}
```

|   |   |
| --- | --- |
| `url` | `ldaps://host:636` (recommended) or `ldap://host:389` with `"start_tls": true`. The certificate is checked against `ca_file` or the system’s certificate store. |
| `bind_dn`, `bind_password_file` | The read-only service account. Empty: anonymous search. |
| `base_dn`, `user_filter` | Where and how users are searched; `{username}` is replaced by the name entered. The example skips disabled accounts. |
| `group_attribute` | Groups on the user entry (`memberOf` in Active Directory). |
| `group_filter`, `group_base_dn` | Optional group search; the example finds nested groups in Active Directory. `{dn}` and `{username}` are replaced. |
| `username_attribute`, `display_name_attribute`, `email_attribute` | Defaults `sAMAccountName`, `displayName`, `mail`. |
| `label` | Name shown on the sign-in page. |
| `timeout_s` | Default 10. |

No extra library is needed: the LDAP client is part of the server.

## Single sign-on (OpenID Connect)

Users click **Sign in with …** and sign in at the company’s identity provider (authorization code flow with PKCE). Signing out also ends the session at the provider.

1. Register a **confidential client** at the provider with the redirect address `<public_url>/api/auth/oidc/callback`.
2. Configure it:
   ```json
   "oidc": {
     "enabled": true,
     "label": "Company SSO",
     "issuer": "https://sso.example.com/realms/example",
     "client_id": "lumiscan-annotation",
     "client_secret_file": "oidc-client.secret",
     "scopes": "openid profile email",
     "username_claim": "preferred_username",
     "groups_claim": "groups"
   }
   ```
3. Set `public_url` (see [Configuration](https://docs.hdvisionsystems.com/en/lumiscan-annotation-web/2.1.0/configuration.html)).
   - **Keycloak:** Client with **Client authentication** on, **Valid redirect URI** as above, **Valid post logout redirect URI** `<public_url>/`, and a mapper \*Group Membership with the claim name `groups`. Alternatively client roles: `"groups_claim": "resource_access.lumiscan-annotation.roles"`.
   - **Microsoft Entra ID:** Issuer `https://login.microsoftonline.com/<tenant>/v2.0`; `"groups_claim": "groups"` (group object IDs) or app roles with `"roles"`.

## Who gets which role

- New directory and single sign-on users get `default_role` (default `annotator`; empty: no role until an admin or a group mapping gives one).
- Names listed in `initial_admins` become admins at their first sign-in.
- **Groups → roles** in the browser gives roles to whole groups; they are refreshed at every sign-in. See [Groups and roles](https://docs.hdvisionsystems.com/en/lumiscan-annotation-web/2.1.0/users-and-roles.html#groups).
- Users without any role cannot sign in; they are told to ask an administrator and are listed for the admins.

Under your name → **Users and sign-in** → **Sign-in methods**, admins see what is configured, the redirect address to register at the provider, and can test a directory sign-in:

![Tab Sign-in methods: local accounts, directory settings with a form to test a directory sign-in, single sign-on settings with the redirect URI](https://docs.hdvisionsystems.com/en/lumiscan-annotation-web/2.1.0/_images/screens/sign-in-methods.png)