---
canonical: https://openvpn.net/cloud-vpn/features/multiple-authentication-systems/
---

# Multiple Authentication Methods

Run SAML SSO and local credentials side by side. Assign the right login method to each user, migrate to SSO at your own pace, and onboard contractors without ever adding them to your corporate directory.

## Run multiple authentication methods together, so every user has a way in

CloudConnexa lets you run multiple authentication methods (SAML Single Sign-On and local username & password) side by side, with per-user control over who uses what. Keep employees on SSO, onboard contractors without adding them to your SSO directory, and keep everyone connected even when your identity provider is unavailable.

## Your workforce isn't one-size-fits-all, your VPN authentication shouldn't be either

Managing VPN access across a mix of employees, contractors, and external partners gets complicated fast, especially when you're limited to a single authentication method. Some teams run on SSO and others on local credentials, and many need both. Contractors and partners often don't belong in your corporate directory, and if your identity provider ever goes down, users still need a way to stay connected.

With CloudConnexa, you can run both SAML SSO and local credentials at the same time, so every user gets the right way in.

## Flexible authentication that rolls out on your terms

You turn each method on or off per user, and it takes effect the first time they sign in with it, so you can expand access without resetting passwords or disrupting anyone already connected.

### Migrate to SAML on your own timeline

Run both methods in parallel and move users to SSO one at a time, then retire local credentials once everyone is across. No hard cutover and no maintenance window.

### Onboard contractors and partners without your directory

Give external users who don't belong in your IdP their own local CloudConnexa credentials, all managed alongside your SSO users in the same account.

### Preserve user continuity when adding SAML

Existing users, groups, and access configurations carry over when SAML is introduced. No disruption, no reassignment.

### Your VPN stays online when your IdP doesn't

Enable local Username & Password alongside SAML, and an identity provider outage no longer locks users out. Anyone with local credentials keeps connecting until SSO is back.

### Give every user the right way to sign in

Authentication is a per-user setting, so you can assign SAML SSO, local credentials, or both to each person individually, instead of applying one method to your entire account.

## Frequently asked questions

### Is multiple authentication methods the same as multi-factor authentication (MFA)?

No. Multi-factor authentication is about adding a second factor (like a one-time code) to a username and password login. Multiple Authentication Methods is about running more than one login method on the same account, and choosing which one each user uses. You can still require MFA/2FA on top of either method.

### Which authentication methods can run at the same time?

SAML Single Sign-On and CloudConnexa Username & Password can run at the same time, while LDAP remains a standalone method.

### Which plans include it?

Multiple Authentication Methods is available on CloudConnexa Premium and Enterprise plans, and not on the Free and Deluxe plans.

### Does enabling it disrupt my current users or force password resets?

No. A method only becomes active for a user the first time they use it, either signing in via SAML or setting a password through the Forgot Password flow. No notifications are sent and no passwords are reset.

### Can I turn it off after enabling it?

Enabling Multiple Authentication Methods is a one-way, irreversible change. You can still disable SAML or Username & Password at the account level afterward, switch the account to LDAP only, or adjust methods per user.

### Does it still support SSO with my existing identity provider?

Yes. CloudConnexa supports SAML SSO with identity providers like Okta, Microsoft Entra ID (Azure AD), and Google Workspace, so users sign in with the corporate credentials and MFA they already have.

### Can I still require 2FA?

Yes. For CloudConnexa Username & Password accounts, two-factor authentication is managed per user and works alongside Multiple Authentication Methods. For SAML, 2FA is handled by your identity provider.