> ## Documentation Index
> Fetch the complete documentation index at: https://docs.slm.m1amdocs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Vindicia External User Authentication Requirements

In order to enable external user authentication to afford SSO access to your users for Subscribe or Retain, the following requirements must be met:

* A corresponding user must exist in the Subscribe/Retain solution.
  * The corresponding user in Subscribe/Retain and in the IDP system must be defined with a matching email address.
  * User authorization governing the user's role is governed by Subscribe/Retain portals.
* The IDP passwords and settings in use must meet PCI password requirements and Vindicia's recommended settings, including:
  * Multi-factor authentication is enabled.
  * Re-authentication is required for Subscribe, if logged out or idle for longer than 15 minutes.
  * Use of complex passwords including 8 characters and at least one of each of the following:
    * Lower Case Letter
    * Upper Case Letter
    * Number
    * Special Character (!@#\$%&\*)
  * Vindicia strongly recommends use of an OTP client as the preferred Multi-factor authentication method such as Google Authenticator.
  * Do not allow use of the users' last 5 passwords.
  * Passwords must be changed every 90 days
* Vindicia accepts an authorization code. The authorization code will be the expected method to grant access.
* Vindicia requires the client id, secret and domain in order to authenticate the authorization code. Send these in an encrypted format once setup is complete.

**Parent topic:**[External User Authentication in Vindicia](../topics/externalUserAuthenticationAbout)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.