Authentication

This page provides guidance on the authentication mechanism that Appian supports, so you can determine which mechanism best meets your organization's needs.

Identity management

Authentication is only a part of the larger identity management strategy you need to consider for your system. The authentication mechanism you pick determines how users access Appian from various devices, but it does not determine how users are created in the system or what authorizations they will have once authenticated. Although you may be using an external authentication provider, Appian requires that local user accounts are created in the personalization engine.

External authentication versus local authentication

Due to the nature of centralized user management, certain system authentication features only apply to locally managed accounts.

The following table lists authentication features and whether they are enforced for locally authenticated or externally authenticated users. Locally authenticated user credentials are validated by Appian.

Feature	Local Authentication	External Authentication
Deactivation of Inactive Users	Yes	Yes
Disabled Login for Deactivated Users	Yes	Yes
Password Complexity Requirements	Yes	No
Password Expiration	Yes	No
Password Expiration Warning	Yes	No
Account Locking (due to failed sign-in attempts)	Yes	No
Temporary Passwords	Yes	No

Resetting passwords with external authentication

If external authentication is enabled in Appian, the password reset process must be handled by the external authentication mechanism. The password reset feature performs in the following manner when external authentication is enabled.

• The link used to change and reset the user's password remains available.
• If a user clicks Reset Password an email is still sent.
• If a user clicks an emailed link to reset their password, it is not reset.

Remember me authentication

Appian authentication and SAML authentication both support the ability to remember users for a certain amount of time. This means that users won't be asked to sign in again until a specific time period has passed.

Remember me uses an authentication token to allow users to bypass the Appian or SAML identity provider sign-in screen. The authentication token is a cookie that replaces the need to enter a username and password and is used only to create an authenticated browser session for a given user on a specific browser or mobile app.

System administrators can modify the authentication validity period and disable the capability site-wide through configuration.

System administrators are never granted a remember me token and must authenticate with their username and password every time they access the system.

You can enable remember me separately for Appian authentication and SAML authentication.

Remember me for Appian authentication

If remember me is enabled for Appian authentication, users can select a Remember Me checkbox when signing in to Appian.

For Appian authentication, remember me is enabled by default—a user must provide their username and password once every two weeks for each browser on which they access Appian.

Remember me also works for users with multi-factor authentication enabled. A valid remember me authentication token bypasses the Appian sign-in screen, so users do not enter a username, password, or verification code. Device trust is a separate multi-factor authentication capability that requires a username and password but can skip the verification challenge on a remembered web browser.

Remember me for SAML authentication

If remember me is enabled for a SAML identity provider, all users that are configured for the identity provider will automatically be remembered for the specified number of days. This setting can be enabled for users signing in either through web browsers, the Appian Mobile app, or both.

Each identity provider that you add can have this configured differently. See SAML for Single Sign-On for more information.

How remember me works

By default, an authentication token is generated for each browser or mobile app on which the user accesses Appian, and this token lasts for the configured amount of time (the validity period).

When an authentication token expires or becomes otherwise invalidated, a user is redirected to either the Appian sign-in page or the SAML providers sign-in page.

Clearing authentication tokens will not invalidate an active browser session, and a browser session can expire without authentication being invalidated. See the section Validity period vs. active browser session for more information.

Clearing an authentication token does not have any impact on a current active browser session, and only takes effect the next time the user attempts to authenticate.

Validity period vs. active browser session

Remember me's validity period is the time during which an authentication token is valid. This period is the duration of time for which the system administrator has configured Remember Me to work in the Admin Console. The validity period can be shortened or terminated by events such as password resets or explicit logouts, and can only be changed by a system administrator.

An active browser session refers to the browsing session a user has after they have authenticated and before the session timeout occurs. Sessions can be configured to last for a specific duration by a system administrator, and accounts for both active and idle portions of time. Session time is configurable in the Admin Console, and by default is 65 minutes.

Clearing authentication tokens by administrators

System administrators can clear authentication tokens for individuals or entire organizations. This means the token will be removed from the Appian data source so that any attempt to use that token will not result in an authenticated session.

The following will clear all authentication tokens associated with a user:

• Deactivating a user.
• Resetting the password for a user. Keep in mind that authentication tokens associated with an active browser session for a user will not be cleared.

Clearing authentication tokens by users

Users can clear their own authentication tokens in the following ways:

• For Appian authentication, changing their own password clears all authentication tokens associated with that user, except the authentication token associated with their current session.
• Clearing cookies in a browser clears the authentication tokens associated with that browser.
• Clicking Sign Out clears all authentication tokens associated with the current browser or mobile app.

Authentication logging

Successful authentication via a remember me token is logged as a successful sign-in. If a user attempts to access Appian using an expired authentication token, this is not logged as a failed sign-in attempt; the user is redirected to the sign-in page to provide their username and password.

Remember me best practices

Remember me and external authentication

Remember me does not interfere with external authentication configuration supported by Appian. System administrators may want to consider configuring (or disabling) remember me to comply with your organization's authentication requirements.

Customers using external authentication integration with strict password expiration policies may want to disable remember me as users whose passwords have expired in the external identity management system are able to access Appian with a valid remember me authentication token until that token expires or is revoked.

Using remember me for SAML with group membership synchronization

Users who authenticate with a valid remember me authentication token will not trigger a group membership synchronization with the SAML identity provider as they would when signing in normally.

Therefore, if you are using Group Membership Synchronization and you need group membership to be absolutely up to date, you may not want to enable remember me for that identity provider.

Deactivating remember me users in a SAML identity provider

If remember me is enabled, when deactivating a user with the SAML identity provider, be sure to also deactivate the user in Appian.

If a user has a valid remember me token, they will still be able to access Appian with that token until their validity period expires. This means that users will still be able to access Appian even if they are deactivated with the SAML identity provider, unless they are deactivated in Appian as well.

Clearing authentication tokens when disabling SAML

If remember me is enabled for Appian authentication, when you disable SAML for a user that has already been remembered, that user will still be able to sign in. The remember me tokens that were issued prior to SAML becoming disabled will still be valid.

To clear authentication tokens for these users, do one of the following:

• Disable remember me for Appian authentication.
• Deactivate (and immediately reactivate if desired) the affected users.

If remember me for Appian authentication is already disabled, no further action is required.

Device trust for multi-factor authentication

Device trust lets users with Appian authentication skip the multi-factor authentication (MFA) challenge on subsequent sign-ins from a web browser they choose to remember. Device trust reduces repeated verification prompts while continuing to require an Appian username and password on every sign-in.

For example, a user who returns to an external portal from the same work browser can enter their username and password without retrieving another verification code during the trust period.

Device trust is disabled by default. An administrator can enable device trust and configure a trust period from one to 90 days. The default trust period is 30 days. A user opts in by selecting Remember this device during MFA verification.

Device trust requirements

Device trust has the following requirements and restrictions:

• Authentication: Device trust requires Appian authentication and MFA. Device trust does not apply to SAML, OpenID Connect, PIEE, or LDAP authentication.
• Client: Device trust works in web browsers. Appian Mobile apps do not support device trust in Appian 26.8.
• Administrator setting: An administrator must enable device trust before users can remember a web browser.
• User choice: A user must select Remember this device during MFA verification for Appian to trust the web browser.
• System administrators: System administrator accounts cannot use device trust and must complete MFA on every sign-in.

Device trust and remember me

Device trust and Remember Me authentication reduce different parts of the sign-in process. Device trust skips only the MFA challenge, while Remember Me authentication bypasses the Appian sign-in screen.

Criteria	Device trust	Remember Me authentication
Credentials bypassed	Device trust can bypass the MFA challenge. Users still enter their Appian username and password.	Remember Me authentication bypasses the Appian or SAML identity provider sign-in screen. A valid authentication token replaces the username, password, and MFA verification code.
Authentication types	Device trust supports Appian authentication.	Remember Me authentication supports Appian authentication and SAML authentication.
Client support	Device trust supports web browsers. Appian Mobile apps do not support device trust in Appian 26.8.	Remember Me authentication supports web browsers and mobile apps for Appian authentication. SAML identity providers can enable Remember Me authentication for web browsers, Appian Mobile apps, or both.
Administrator control	Device trust is disabled by default. An administrator enables device trust and configures a trust period.	Remember Me authentication is enabled by default for Appian authentication. Administrators configure Appian authentication and SAML authentication separately.
User choice	Users select Remember this device during MFA verification.	Appian authentication users select Remember Me on the sign-in page. SAML authentication remembers users automatically when the identity provider setting is enabled.
Duration	Administrators configure device trust from one to 90 days. The default is 30 days.	Administrators configure the Remember Me authentication validity period. Appian authentication requires credentials once every two weeks by default, and the maximum validity period is 90 days.
Revocation	Users and administrators can revoke device trust.	Administrators can clear authentication tokens. Users can clear authentication tokens by changing their Appian password, clearing browser cookies, or signing out, depending on the token and session.
System administrators	System administrator accounts cannot use device trust and must complete MFA on every sign-in.	System administrator accounts never receive a Remember Me authentication token and must enter their username and password on every sign-in.

Device trust and Remember Me authentication are independent settings. Enabling one setting does not enable the other.

Users can revoke device trust in user settings. System administrators can revoke device trust for a user.

Configuring authentication

The following table summarizes the authentication methods available with Appian.

Each row lists:

• The authentication method.
• Whether the method is available to users working in a browser or on a mobile device.
• Whether the method supports single sign-on (SSO).
• The level of configuration and administration effort required for the method.

Method	Browser	Mobile	SSO	Effort
Appian Authentication	Form Login	Yes	No	ZERO
LDAP Authentication	Form Login	Yes	No	LOW
OpenID Connect Authentication	Provider specific	Yes	Yes	MEDIUM
PIEE Authentication	Provider specific	No	Yes	MEDIUM
SAML Authentication	Provider specific	Yes	Yes	MEDIUM

Appian can authenticate users via other authentication mechanisms (such as Kerberos, request header pre-authentication, central authentication service, or certificate-based authentication) by integrating with a SAML identity provider that uses those mechanisms to authenticate users.

Customers upgrading from a version of Appian prior to 7.11 should note that support for custom Spring Security configurations has been deprecated and Appian encourages you to convert your authentication configuration to one of the three out-of-the-box authentication mechanisms listed below.

Appian authentication

Standard Appian authentication is configured out of the box and allows for configuration of password policies. For a complete list of configuration options, see Appian Authentication.

LDAP authentication

Appian allows you to configure user authentication against an external directory server. This method does not require work with configuration files and is done through the Admin Console. It allows usage of the same corporate logon information but does not support Single Sign-On.

For a complete list of configuration options, see LDAP Authentication.

OpenID Connect authentication

OpenID Connect (OIDC) is a modern standard that's built on top of the OAuth 2.0 protocol. When configured, OIDC can be used to establish single sign-on (SSO).

Administrators can configure user authentication against an OpenID Provider in the Admin Console.

When OpenID Connect authentication is enabled, unauthenticated users without a web address identifier in their URL will be redirected based on the default sign-in page.

For instructions on configuring OpenID Connect as well as a complete list of configuration options, refer to OpenID Connect User Authentication.

PIEE authentication

The Procurement Integrated Enterprise Environment (PIEE) is the primary enterprise procure-to-pay (P2P) application for the Department of Defense and its supporting agencies. PIEE user authentication can be used for single sign-on to procurement-related systems. This article describes how to configure PIEE authentication in the Appian Admin Console.

Administrators can configure user authentication against a SAML identity provider server in the Admin Console.

When PIEE authentication is enabled, it will disable user authentication with any configured identity providers that use SAML or LDAP. However, if you configure the Authentication Group in PIEE's Appian Settings correctly, certain users will still be able to sign in with Appian Authentication.

SAML authentication

SAML is a set of standards that govern communication between a service provider (in this case Appian), a client, and an identity provider. The standards allow for secure exchange of authentication information over multiple domains and environments.

Administrators can configure user authentication against a SAML identity provider server in the Admin Console.

When SAML authentication is enabled, unauthenticated users without a web address identifier in their URL will be redirected based on the default sign-in page.

For instructions on configuring SAML identity providers as well as a complete list of configuration options, refer to SAML for Single Sign-on.

Troubleshooting

The following troubleshooting methods are useful when researching common problems with authentication. Otherwise, contact Appian Support if you need assistance configuring or troubleshooting external authentication.

Analyze network traffic

Network traffic analyzers can help diagnose problems related to communication between the user's browser and the server. Use your browser's built-in network capture tools for high level information. If insufficient, use other tools like WireShark and Fiddler to provide very detailed network traffic data.

Feedback