> ## Documentation Index > Fetch the complete documentation index at: https://docs.slm.m1amdocs.com/llms.txt > Use this file to discover all available pages before exploring further. # Vindicia Portal Users and Authentication ## Portal User Authentication and Authorization In order to log in to the Portals, users must authenticate themselves- verify their identity. The following 3 main methods are supported: * Vindicia IDP 1,0 or 2,0- see details below * External User Authentication- see details below * Portal-generated passwords- see details below For authorization, roles are created based on permissions and group association. Authorization (permissions) source varies. External User IDPs and the native, Portal generated Passwords authorization and role assignment are managed in the Vindicia Portals (Subscribe and Retain) themselves. For Vindicia IDPs we're in a mixed mode approach. Vindicia IDP 1.0 uses authorization based on Vindicia Portal roles. Vindicia IDP 2.0, uses authorization defined in Vindicia IDP 2.0 console (ULM). When a merchant is created in Vindicia, they provide a list of authorized users that will be able to access Vindicia Portal (Subscribe or Retain) and the users roles for the merchant account. To learn about the supported roles and permissions available for merchant staff, see: * [Subscribe User Roles](https://docs.vindicia.com/bundle/Subscribe_Portal2_User_Guide/page/topics/portalUserRoles.html) * [Retain User Roles](https://docs.vindicia.com/bundle/b_retainPortalUserGuide/page/topics/portalRetainUserRoles.html) Traditionally, user creation required an Internal Vindicia employee. With the new Vindicia IDP 2.0 merchant administrative users will be able to add new users on their own. For all others, Vindicia support and MC are still needed. Once a user is created, the merchant's admin user (super user) may have user management rights if using the Vindicia IDP (ulm) 1.0 and 2.0 console, or an external IDP such as OKTA. ## Internal User Roles Employees that require access to the Vindicia Portals to provide support are limited. Access to production data is not provided to most employees. Vindicia Internal users that need to provide support to merchants are defined as one of the following roles: * **Chargeback Team** - Provides access to chargeback analysts. Includes the following permissions (groups): | chargeguard | crm | cs\_mgr | employee | cs | internal\_login | | - | - | - | - | - | - | * **Employee** - The role allows an employee to see most of the Vindicia areas except the admin ones. It includes the following permissions (groups): | crm | cs\_mgr | employee | cs | internal\_login | dev | | - | - | - | - | - | - | | exec | finance | imp | merch\_config | mgr | select | | select\_admin | tam | merchant\_cs | merchant\_cs\_mgr | report | report\_schedule | | cashbox | dashboard | report\_catalina | | | | * **Admin** - This is the most comprehensive of the internal roles with the most visibility. When assigning it there is no need to also assign other internal roles. It includes the following permissions (groups): | crm | cs\_mgr | employee | cs | internal\_login | dev | | - | - | - | - | - | - | | exec | finance | imp | merch\_config | mgr | select | | select\_admin | tam | merchant\_cs | merchant\_cs\_mgr | report | report\_schedule | | cashbox | dashboard | report\_catalina | chargeguard | admin | | When defining the internal user role in either Portal 1 or in Vindicia IDP 2.0 console, an admin user should just be defined with the Admin role and no other as it includes all the other permissions. If an employee needs access to ChargeGuard but is not an admin, then define both **Employee** and **Chargeback Team** roles. ## Vindicia Identity Provider (IDP) Because Vindicia must meet financial data management and access requirements as prescribed by PCI and ISO security requirements, advanced authentication capabilities have been implemented, namely, **Vindicia IDP**. Vindicia IDP utilizes MarketONE Connect (ULM) – an Amdocs product, which provides us a seamless integration with an advanced Identity and Access Management (IAM) product. It provides protection against unauthorized access as well as: * **Multi-Factor Authentication (MFA)**: Multi-Factor Authentication is a secure authentication method requiring identity verification by supplying two or more identifying details (also called factors) when a user logs in. In Vindicia IDP, For Multi-Factor Authentication set up, you can use either your email as an identifying factor or an authenticator app. * **Unique passwords requirements**: limits past password reuse ( by default set to 5 in Vindicia IDP) and password lifetime - how long a single password can be reused (default 90 days). For more details, see [Password Requirements](passwordRequirements_r). * **Complex passwords**: Password must be at least 8 characters long and must include at least one uppercase letter, one lowercase letter, one numerical digit, and one special character. Vindicia Offers 2 versions of the Vindicia IDP console: * [**Vindicia IDP Console 1.0**](https://docs.vindicia.com/bundle/b_vindiciaCareIDP/page/topics/userManagement1Capabilites_r.html) - Offers merchant administrator users (Super users with care representative privileges) the ability to manage basic user identity settings for organizational users such as reset password, or reset multi-factor authentication methods. When using Vindicia IDP 1.0, users are still added by Vindicia Internal and authorization (roles) are managed and sources in Vindicia Portal 1.0 * [**Vindicia IDP Console 2.0**](https://docs.vindicia.com/bundle/b_vindiciaCareIDP/page/topics/userManagement2Capabilites_r.html) - Offers merchant administrator users the ability to manage extended user settings such as adding new users, setting roles for users, resetting passwords and more. If using Vindicia IDP, merchant administrative users will need to be defined as a care representative in the Vindicia IDP console. For more details, see [Vindicia IDP console guide](https://docs.vindicia.com/bundle/b_vindiciaCareIDP/page/topics/careIntroduction_c.html). Merchant admin and internal admin users can access the Vindicia IDP Care console through the Subscribe and Retain Merchant Portals by clicking **Account Settings** > **Manage Users**. ## User Management Roles (ULM Roles) for Vindicia IDP The roles listed above provide access to the Vindicia portals (Subscribe and Retain). Besides them, there are user management roles that are needed for the Vindicia IDP deployment that allow internal and external users to have access to the Vindicia IDP consoles and to manage users. * Super admin: This role provides access not only to the User management section of the Vindicia IDP console but also to other setting area. This role should never be defined for a merchant user. For internal users, it would only be relevant for admin users that are responsible to assign roles to merchant users in Vindicia IDP 1.0 (as part of the admin console). **Note:** For Vindicia IDP 2.0 this role is not needed for assigning roles * Care representative: This roles lets the holder perform user management actions for the merchant tenants to which they have access. The user management breadth of actions that can be performed are defined based on the merchant config of Vindicia IDP 1.0 or Vindicia IDP 2.0. ## External User Authentication Optionally, Merchants can request to use **external user authentication** via their Identity Provider using OIDC-standards. Any OIDC- based provider can be supported, like OKTA IDP or Microsoft Azure. For more details and requirements, see [External User Authentication](https://docs.vindicia.com/bundle/subscribeImplementationGuide/page/topics/externalUserAuthenticationAbout.html). ## Portal-Generated Passwords In Vindicia's QA and Staging environments, users can use Subscribe or Retain Portal native **portal-generated passwords** for login and authentication. * **[Configuring Vindicia IDP 2.0 as Merchant IDP Authentication](../topics/vinIDP2.0Config_r#)** * **[Configuring Merchant Authentication with Vindicia IDP 1.0 and User Definition](../topics/subscribeUserAuthentication_r#)** * **[Password Requirements](../topics/passwordRequirements_r)** This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.