> For the complete documentation index, see [llms.txt](https://docs.subsalt.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.subsalt.io/administration/authentication-and-sso.md).

# Authentication & SSO

Subsalt can integrate with many [SSO identity providers](https://workos.com/docs/integrations) and can also self-manage accounts via an internally-hosted [Keycloak instance](https://www.keycloak.org/). Organizations are limited to *either* SSO via an identity provider or Subsalt-managed accounts; if you need to support both then you can create multiple organizations to manage more complex user configurations.

Read more about [User management](/administration/user-management.md) for Subsalt-managed accounts.

### Authenticating to query endpoint

All users must use a Subsalt-managed password for connecting to the query endpoint; users can update their passwords themselves in the **Profile > Access credentials** section of the portal.

Administrators can also reset passwords for other users in the **Organization > Accounts** section of the portal. Read more about this functionality in the [User management](/administration/user-management.md) section.

{% hint style="info" %}
Subsalt requires that users in SSO-based organizations create a dedicated password for [Running queries](/retrieving-data/running-queries.md); this security precaution ensures that the Subsalt system is never exposed to sensitive credentials that it's not responsible for managing.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.subsalt.io/administration/authentication-and-sso.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.