---
path: onboarding/admin-onboarding/phase-1-infrastructure.mdx
title: "Phase 1: Infrastructure and authentication"
sidebar_label: "Phase 1: Infrastructure & auth"
sidebar_position: 2
slug: phase-1-infrastructure
pagination_next: null
pagination_prev: null
description: >-
  Passwork rollout Phase 1: configuring LDAP/Active Directory integration, SSO (SAML/OIDC),
  and global authentication policies including mandatory 2FA and account lockout rules.
keywords:
  - Passwork
  - LDAP
  - Active Directory
  - SSO
  - SAML
  - OIDC
  - authentication
  - 2FA policy
  - account lockout
  - infrastructure
  - phase 1
---

**Estimated time:** ~4 hours  
**Responsible:** Server Admin, LDAP Admin, IdP/SSO Admin  
**Outcome:** Users can authenticate via corporate credentials; global security policies are enforced.

---

## 1.1 Configure LDAP / Active Directory integration

LDAP integration enables users to sign in to Passwork using their domain credentials, and allows automatic import of user lists and security groups from Active Directory.

### Add an LDAP server

1. In Passwork, go to **Settings and users → LDAP settings**.
2. Click **Add server** and enter the LDAP server connection parameters.

<ImageComponent
  src="/img/assets/ldap-settings.png"
  alt="LDAP settings page"
  format="regular"
/>

<ImageComponent
  src="/img/assets/ldap-settings-2.png"
  alt="Add LDAP server — connection parameters"
  format="regular"
/>

Required parameters:

| Parameter | Description |
|-----------|-------------|
| **Server address** | LDAP server hostname or IP (e.g., `ldap://dc.corp.local` or `ldaps://dc.corp.local:636`) |
| **Port** | 389 for LDAP, 636 for LDAPS |
| **Bind DN** | Service account distinguished name |
| **Bind password** | Service account password |
| **Base DN** | Root distinguished name for user and group search |

For LDAPS (encrypted LDAP over TLS), see [LDAPS Configuration](https://passwork.pro/tech-guides/administration/ldap-settings/ldaps-configuration-example/ldaps-manuals-docker/).

### Configure user synchronization

After adding the server, configure which user attributes map to Passwork fields and define the DN filter to scope which users are imported.

See [LDAP Users](https://passwork.pro/tech-guides/administration/ldap-settings/users/) and [DN Filters](https://passwork.pro/tech-guides/administration/ldap-settings/dn-filters-features-and-examples/) for detailed instructions.

### Link LDAP security groups to Passwork groups

Map Active Directory security groups to Passwork groups so that group membership is maintained automatically.

See [LDAP groups](https://passwork.pro/tech-guides/administration/ldap-settings/groups/) and [LDAP synchronization](https://passwork.pro/tech-guides/administration/ldap-settings/synchronization/).

### Test the LDAP connection

After configuration, run an authorization test to verify the connection and confirm that a test user can authenticate.

<ImageComponent
  src="/img/assets/ldap-settings-3.png"
  alt="LDAP authorization test — enter test credentials"
  format="regular"
/>

<ImageComponent
  src="/img/assets/ldap-settings-4.png"
  alt="LDAP authorization test — result"
  format="regular"
/>

See [LDAP authorization test](https://passwork.pro/tech-guides/administration/ldap-settings/authorization-test/).

---

## 1.2 Configure SSO (Single Sign-On)

SSO integration allows users to sign in to Passwork using their existing identity provider session, with no separate Passwork password required.

Passwork supports SAML 2.0 and OIDC. Supported identity providers include:

- Microsoft Entra ID (Azure AD)
- AD FS
- Keycloak
- Any SAML 2.0 or OIDC-compliant IdP

### SSO configuration steps (overview)

1. Create a SAML or OIDC application in your identity provider for Passwork.
2. In Passwork, go to **Settings and users → SSO Settings**.
3. Enter the IdP metadata or endpoint URLs and the client credentials.
4. Configure SSO as the priority login method if required.

<ImageComponent
  src="/img/assets/sso-settings.png"
  alt="SSO settings page"
  format="regular"
/>

For provider-specific instructions:

- [SSO with Microsoft Entra ID (Azure AD)](https://passwork.pro/tech-guides/administration/sso-settings/sso-configuration-with-microsoft-entra-id-azure-ad/)
- [SSO with AD FS](https://passwork.pro/tech-guides/administration/sso-settings/sso-configuration-with-ad-fs/)
- [SSO with Keycloak](https://passwork.pro/tech-guides/administration/sso-settings/sso-configuration-with-keycloak/)

:::tip Cloud vs. on-premise
For cloud-hosted instances, the SSO callback URL (Assertion Consumer Service URL) is provided by Passwork during tenant provisioning. For on-premise installations, it is based on your configured `APP_URL`.
:::

---

## 1.3 Configure global authentication policies

Global authentication policies apply to all users on the Passwork instance. Configure them before inviting users.

Navigate to **Settings and users → System settings → Authorization and security**.

<ImageComponent
  src="/img/assets/GZYrl6yW_3X-w9xLC3Ctd_7421-settings-system-settings-default-authorization-and-security.png"
  alt="System settings — Authorization and Security"
  format="regular"
/>

### Mandatory two-factor authentication

Enable the **Require 2FA** toggle to make two-factor authentication mandatory for all users. When enforced, users are prompted to set up 2FA on their next login before they can access any vaults.

### Account lockout policy

Configure the maximum number of failed authentication attempts before an account is locked. A locked account requires administrator intervention to unlock.

Recommended setting: **5 failed attempts**, lock duration **15 minutes** or until manual unlock.

### Session management

Set the session timeout (auto sign-out after inactivity) and the maximum session lifetime. For organizations handling sensitive data, a session timeout of 30–60 minutes is recommended.

### Master password complexity policy

If client-side encryption is enabled, configure the minimum complexity requirements for the master password: minimum length, required character classes.

See [Client-side encryption](https://passwork.pro/tech-guides/administration/client-side-encryption/client-side-encryption/) for details on enabling and managing client-side encryption.



## 1.4 Configure email notifications (SMTP)

Email is required for invite delivery, password reset notifications, and security alerts. Configure SMTP before inviting any users — without it, invite emails will not be delivered.

Navigate to **Settings → System settings → Email service settings**.

<ImageComponent
  src="/img/assets/email-notification-setup-manual-configuration-1-w9i8uth2.png"
  alt="Email notification setup — manual configuration"
  format="regular"
/>

### Configuration options

Passwork supports two email configuration methods:

**Manual configuration** — specify SMTP server host, port, encryption (TLS/STARTTLS), username, and password directly. Use this for internal SMTP relays (Exchange, Postfix) or cloud SMTP services (SendGrid, Amazon SES, Mailgun).

**DSN (Data Source Name)** — configure via a connection string. Suitable for automated deployments.

For detailed configuration instructions by platform:

- [Manual SMTP configuration](https://passwork.pro/tech-guides/administration/email-notification-setup/manual-configuration/)
- [DSN configuration](https://passwork.pro/tech-guides/administration/email-notification-setup/dsn/)
- [Postfix relay (Linux)](https://passwork.pro/tech-guides/administration/email-notification-setup/local-service/postfix/linux/)
- [Postfix relay (Docker)](https://passwork.pro/tech-guides/administration/email-notification-setup/local-service/postfix/docker/)
- [Windows SMTP relay](https://passwork.pro/tech-guides/administration/email-notification-setup/local-service/windows-smtp/)

### Test email delivery

After saving the configuration, send a test email from **Settings → System settings → Email service settings** to verify that messages are delivered and are not blocked by spam filters.

:::tip
Check the sender domain's SPF record and ensure the SMTP relay is authorized to send on behalf of your `APP_SENDER_EMAIL` address. invite emails landing in spam are one of the most common reasons for low user activation rates.
:::

---

## Phase 1 completion criteria

- [ ] LDAP or SSO authentication tested successfully with at least one user
- [ ] Mandatory 2FA policy configured (enabled or explicitly deferred)
- [ ] Account lockout policy configured
- [ ] Session timeout configured
- [ ] SMTP configured and test email delivered successfully
- [ ] A test user can sign in via corporate credentials and access Passwork

Proceed to [Phase 2: Structure and roles](./phase-2-structure.mdx).