--- title: Turbine Login and Authentication Methods slug: turbine-user-guide/turbine-login-and-authentication-methods docTags: createdAt: 2025-08-11T11:13:45.000Z --- Swimlane Turbine supports multiple login methods, depending on how authentication is managed within your organization. The following sections provide an overview of each supported login method. :::hint{type="info"} **On-Prem (Turbine 26.3.0):** Administrators can customize the text in the welcome area of the login page (next to the sign-in form). To configure it, see [Welcome Message](docId\:uhjeOdxu3zVVNEkllXlzB) under **Account Settings** > **General**. That topic covers HTML support, the default message, and how to clear a custom message. ::: 1. Single Sign-On (SSO): You can sign in to Turbine using SSO in two ways: **Identity provider (IdP)-initiated** or **Service Provider (SP)-initiated**. Both methods use SAML 2.0 for authentication through an external IdP. - [Identity Provider (IdP)-Initiated SSO Login](https://docs.swimlane.com/turbine-login-and-authentication-methods#identity-provider-idp-initiated-sso-login) - Login starts directly from the Identity Provider portal (for example, Okta, JumpCloud, Google Workspace, and so on). - The IdP authenticates the user and redirects to Turbine. - [Service Provider (SP)-Initiated SSO Login](./#service-provider-sp-initiated-sso-login) - Login starts from the Turbine application (for example, [https://us1.swimlane.app](https://us1.swimlane.app)). - Provide an Account Alias which enables Turbine to determine which IdP to redirect the user to. - The IdP authenticates the user and redirects to Turbine 2. [LDAP Login](./#ldap-login) - Authentication is handled by the external **LDAP directory** (for example, Microsoft Active Directory or OpenLDAP). - Credentials are validated against the directory, and access is granted upon successful authentication. 3. [Application-Managed Login](./#application-managed-login) - Credentials are stored directly within Turbine. - When a user logs in, Turbine authenticates the users. :::hint{type="info"} After an inactivity timeout or a manual logout, the user is redirected to the same page they were on before. This behavior is user-specific and ensures each user is logged back into their last visited page in the application. ::: ## Identity Provider (IDP)-Initiated SSO Login IdP-initiated SSO begins from your organization's identity provider portal (for example, Okta, JumpCloud, or Google Workspace). After you select the Turbine app, the IdP authenticates your credentials and redirects you to Turbine. ::Image[]{src="https://api.archbee.com/api/optimize/511c8QBH-VHiwWnyzIwUb/X_mHYu1on7izxyFev9ScO_idp-sso-login.png" size="96" width="981" height="395" darkWidth="800" darkHeight="321" position="center" showCaption="false"} To sign in using IdP-initiated SSO: 1. Sign in to your organization's IdP portal. 2. Select the Turbine application. ::Image[]{src="https://api.archbee.com/api/optimize/511c8QBH-VHiwWnyzIwUb/-A80kRr8-WRCJ8bS3Slo5_idp-console.png" size="76" width="847" height="492" darkWidth="800" darkHeight="465" position="center" showCaption="false"} 3. If Multi-Factor Authentication (MFA) is required, complete the verification(Optional). 4. Turbine validates the response, and logs you in. ## Service Provider (SP)-Initiated SSO Login SP-initiated SSO begins from the Turbine login page. Enter your **alias** or **email address**, then Turbine routes you to the correct IdP for authentication. ::Image[]{src="https://api.archbee.com/api/optimize/511c8QBH-VHiwWnyzIwUb/InrZZERLqh9GgQl8cFXqr_sp-sso.png" size="82" width="1185" height="574" darkWidth="800" darkHeight="387" position="center" showCaption="false"} Steps to log in via SP-initiated SSO: 1. Navigate to Turbine (for example, [https://us1.swimlane.app](https://us1.swimlane.app)). 2. Select **Login via SSO**. 3. Enter your **alias** or **email address**: - **Alias** — routes login to the SSO configuration with that alias. - **Email address** — Turbine looks up your account and uses your mapped SSO configuration. :::Paragraph{indent="1"} Some accounts show **Alias** only (alias-only login mode). ::: 4. When redirected to your IdP, sign in using your IdP credentials. 5. If Multi-Factor Authentication (MFA) is required, complete the verification. 6. Turbine validates the response and logs you in. ### What Is an Account Alias? An account alias is a short, unique string assigned to an SSO configuration in Turbine. Turbine uses it to identify which IdP to use during SP-initiated login when the user enters an alias instead of an email address. ### Why Use an Account Alias? - **Routing to the correct IdP** when multiple SSO providers are configured - **Simplified user experience** — users enter the alias and Turbine directs them to the correct login provider ### Configure the Alias (Admin Only) To configure an alias for SAML-based SSO: 1. Navigate to **Settings** > **Account** > **Account Settings**. 2. Open the **Sessions & Security** tab. 3. Expand **Authentication**, turn **Enable** on under **SAML Authentication**, and click **SAML Settings**. 4. Enter the **Alias** in the **SAML Authentication** dialog. 5. Complete the remaining IdP and service provider fields, click **Apply**, then click **Save** on **Account Settings**. For the full procedure, see [Enable SAML for SSO](docId\:iRgxCHUYJMsyPLQdq3duh). ## LDAP Login LDAP login allows authentication using credentials stored in an external **LDAP directory**, such as **Microsoft Active Directory** or **OpenLDAP**. Turbine connects to the configured LDAP server using the LDAP protocol to validate credentials. ![](https://api.archbee.com/api/optimize/511c8QBH-VHiwWnyzIwUb/cyjqlWcsqRIk7xcwLPhUQ_ldap-login.png) To sign in using LDAP: 1. Go to [https://us1.swimlane.app](https://us1.swimlane.app/). 2. Enter your LDAP username or email address and password. 3. Turbine connects to the LDAP server to validate your credentials. 4. If Multi-Factor Authentication (MFA) is required, complete the verification.(Optional) 5. Turbine validates the response, and logs you in. ## Application-Managed Login Application-managed login is handled entirely within Turbine. Credentials are stored and verified by the application, without relying on an external identity provider. ![](https://api.archbee.com/api/optimize/511c8QBH-VHiwWnyzIwUb/XISmJJ0PqqC9dstpkH4E9_app-managed-login.png) To sign in as an application-managed user: 1. Go to [https://us1.swimlane.app](https://us1.swimlane.app/). 2. Enter your registered email address or username and password. 3. Turbine validates your credentials. 4. If Multi-Factor Authentication (MFA) is required, complete the verification.(Optional). 5. Turbine validates the response, and logs you in. ### Resetting a Forgotten Password If you forget your password: 1. On the login screen, click **Forgot Password?**. 2. Enter your registered email address. 3. Check your inbox for the password reset email. 4. Follow the link to **create and confirm** a new password. 5. Return to the login screen and sign in with the new password. ## See Also - [Welcome Message](docId\:uhjeOdxu3zVVNEkllXlzB) — customize the On-Prem login page welcome area (**Account Settings** > **General** > **Login Experience**) - [General](docId\:N5UJtlAhGA-0mlnYuwQwe) — Account Name, Domain, and Custom Domain - [Account Settings Overview](docId:5VWyahVwK97TQAvrIYiuA)