Forum Discussion

HoangT's avatar
HoangT
Ideator I
20 days ago

[ARAS 14] Change display order of authentication options

Hello! My company is using ARAS Innovator 14 (release 39). We have two authentication options: Entra ID SSO and local user.
By default, the local login option is displayed first in the login page, and we have to choose the SSO option from the drop-down menu.
I want to know if there's a build-in method allowing me to change the display order of those two authentication options? Like a config file, a button on AWS console, etc.?

I have read through the ARAS documents come with the installer, but there's nothing regarding this matter. Searching through Google and AI didn't help me find any discussions about this topic too.
If anyone know about this, please share your experience with me! Thank you!

Here's the screenshot of the login page. 
The 'Aras Innovator' option allows me to login using local username and password.
The 'Azure AD' allows me to login using my company SSO account.

Extra discussions: My manager also asked if we could disable the local login option, only leave the SSO one in the login page.
As I understand, this is not possible with the backend of ARAS, as each SSO user need to be associated with a local user of the same name. And we should keep the ability to login ARAS with local admin/root account in case SSO has issue. But that's just my understanding, please correct me if you have different opinion/best practice about that!

Access Control
Login
release 14+
Security

5 Replies

  • mconstantin_aras_com's avatar
    mconstantin_aras_com
    Creator III
    18 days ago

    Good Morning

    I am not aware of a supported built-in method to change the order of authentication providers in the "Login with" drop-down. The authentication plugins expose an AuthenticationType and a DisplayName, but I have not found any documented configuration option that controls the order in which providers are displayed.

    If your goal is to make Azure AD / Entra ID the preferred login method, you may want to investigate the Default Authentication Plugin. This OAuth Server plugin allows administrators to define a DefaultAuthenticationType, which can automatically preselect or redirect users to a specific authentication provider instead of requiring users to choose from the drop-down.

    The plugin is configured in the OAuth Server configuration. The documentation provides the following example:

    {
         "Name": "Aras.OAuth.Server.Plugins.DefaultAuthentication",
         "Enabled": true,
         "Options": {
              "DefaultAuthenticationType": "<AuthenticationType>",
              "DefaultDatabase": "<Database>"
         }
    }

    DefaultAuthenticationType must match the authentication provider's configured AuthenticationType, not necessarily the display name shown to users in the login page.

    Regarding disabling the local Aras Innovator login option entirely, I would recommend keeping it available. Even if all regular users authenticate through Entra ID, maintaining at least one local administrative login is a good practice:

    • SSO providers can occasionally experience outages.
    • Certificates or trust relationships can become misconfigured.
    • Network issues can prevent access to the identity provider.
    • A local account provides a recovery path if the SSO configuration needs to be repaired.

    In practice, many organizations keep local login available for administrative recovery while directing normal users to SSO by configuring a default authentication provider.

    Regards

    Michael

    • HoangT's avatar
      HoangT
      Ideator I
      14 days ago

      Thank you for your reply,
      Per your suggestion, I have tried searching for keywords "Default Authentication Plugin" and "Aras.OAuth.Server.Plugins.DefaultAuthentication" of ARAS but couldn't find any documents about it. At least, that's the result of searching using Google, community.aras.com and docs.aras.com.
      Could it be that it's a premium feature of ARAS, so it doesn't have public documents?
      Or in case my keywords are not the right one, can you share a document link with me?
      Much appreciated!

  • angela's avatar
    angela
    Catalyst II
    16 days ago

     The only option I know to change the sort order is manipulating the dropdown on runtime. This requires only a few lines in the code tree. Bu

    • HoangT's avatar
      HoangT
      Ideator I
      14 days ago

      Thank you for your reply,
      Yes, our company's development team did think about that option. But we're trying to search for a native solution before modifying the code tree. Some of our minor modifications in the past versions of ARAS introduced bugs after updating to later release, so we want to avoid that if we can.

      • angela's avatar
        angela
        Catalyst II
        14 days ago

        I don´t think a modification like this will be possible without touching the code tree at all. But its only one file and all you want to do is changing the sort order of something. From my POV in this sepcific case the worst thing that can go wrong during update is that the feature is forgotten to be migrated too.

        I never had big trouble with codetree modifications. Just ensure to document the changed files so you can inform Aras before the upgrade. Write a testcase in your test plan that covers the feature. 

        But let us know if you are able to find a more elegant solution for this use case!