Forum Discussion

HoangT's avatar
HoangT
Ideator I
2 days ago

[ARAS 14] Change display order of authentication options

Hello! My company is using ARAS Innovator 14 (release 39). We have two authentication options: Entra ID SSO and local user.
By default, the local login option is displayed first in the login page, and we have to choose the SSO option from the drop-down menu.
I want to know if there's a build-in method allowing me to change the display order of those two authentication options? Like a config file, a button on AWS console, etc.?

I have read through the ARAS documents come with the installer, but there's nothing regarding this matter. Searching through Google and AI didn't help me find any discussions about this topic too.
If anyone know about this, please share your experience with me! Thank you!

Here's the screenshot of the login page. 
The 'Aras Innovator' option allows me to login using local username and password.
The 'Azure AD' allows me to login using my company SSO account.

Extra discussions: My manager also asked if we could disable the local login option, only leave the SSO one in the login page.
As I understand, this is not possible with the backend of ARAS, as each SSO user need to be associated with a local user of the same name. And we should keep the ability to login ARAS with local admin/root account in case SSO has issue. But that's just my understanding, please correct me if you have different opinion/best practice about that!

Access Control
Login
release 14+
Security

1 Reply

  • mconstantin_aras_com's avatar
    mconstantin_aras_com
    Creator II
    6 hours ago

    Good Morning

    I am not aware of a supported built-in method to change the order of authentication providers in the "Login with" drop-down. The authentication plugins expose an AuthenticationType and a DisplayName, but I have not found any documented configuration option that controls the order in which providers are displayed.

    If your goal is to make Azure AD / Entra ID the preferred login method, you may want to investigate the Default Authentication Plugin. This OAuth Server plugin allows administrators to define a DefaultAuthenticationType, which can automatically preselect or redirect users to a specific authentication provider instead of requiring users to choose from the drop-down.

    The plugin is configured in the OAuth Server configuration. The documentation provides the following example:

    {
         "Name": "Aras.OAuth.Server.Plugins.DefaultAuthentication",
         "Enabled": true,
         "Options": {
              "DefaultAuthenticationType": "<AuthenticationType>",
              "DefaultDatabase": "<Database>"
         }
    }

    DefaultAuthenticationType must match the authentication provider's configured AuthenticationType, not necessarily the display name shown to users in the login page.

    Regarding disabling the local Aras Innovator login option entirely, I would recommend keeping it available. Even if all regular users authenticate through Entra ID, maintaining at least one local administrative login is a good practice:

    • SSO providers can occasionally experience outages.
    • Certificates or trust relationships can become misconfigured.
    • Network issues can prevent access to the identity provider.
    • A local account provides a recovery path if the SSO configuration needs to be repaired.

    In practice, many organizations keep local login available for administrative recovery while directing normal users to SSO by configuring a default authentication provider.

    Regards

    Michael