---
title: Settings - Claims-based authentication
---
> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).
You can access these settings in the **Settings** application under the **Security & Membership** -> **Authentication** -> **Claims-based authentication** category. On this tab, you can adjust settings related to [Claims-based authentication](https://docs.kentico.com/13/managing-users/user-registration-and-authentication/claims-based-authentication.md).
> **Note:** **Note**: You may need to [set up SSL for your site](https://docs.kentico.com/13/securing-websites/deploying-websites-to-a-secure-environment/configuring-ssl.md) to use certain identity providers.
| General (Administration only) | |
| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Enable WIF authentication | Enables claims-based authentication.
Users need to sign in through the identity provider specified by the settings below (for example [Active Directory Federation Services](https://msdn.microsoft.com/en-us/library/bb897402.aspx)). Disables the standard authentication mechanisms in Xperience. |
| Identity provider URL | Specify the URL of your identity provider's **WS-Federation passive endpoint**.
You can find the value in the provider's configuration interface or WS-Federation metadata.
Example: _https://adfs.net/adfs/ls_ |
| Security realm | Enter a URI that identifies your website or application. You can use your website's **domain name** (and virtual directory if applicable) in most cases.
The value must be exactly the same as in the **relying party** configuration of your identity provider, including letter case, any trailing slashes and the protocol (http or https). |
| Allowed audience URIs | URIs of allowed audience for the identity provider, separated by semicolons. The value must match the corresponding relying party settings of your identity provider, including letter case, any trailing slashes and the protocol (http or https).
Use the base domain name on which your Xperience administration application is running. |
| Trusted certificate thumbprint | Enter the thumbprint of the certificate used to secure the communication between Xperience and the identity provider. You can typically find the certificate thumbprint in the provider's Key/Certificate configuration. |
| Certificate validator | Sets the validation mode used for the X.509 certificate specified in the **Trusted certificate thumbprint** setting.
**Chain trust** – accepts certificates whose chain of trust leads to a trusted certification authority. The certificate must be installed on the server hosting Xperience in the _Local Computer -> Trusted People_ certificate store.
**Peer trust** – accepts self-issued certificates. The certificate must be installed on the server hosting Xperience in the _Local Computer -> Personal_ certificate store.
**Peer or chain trust** – accepts self-issued certificates, or certificates with a chain that leads to a trusted certification authority.
**None** – no validation of the certificate is done and the system accepts any certificate with the given thumbprint.
See [Working with Certificates](https://docs.microsoft.com/en-us/dotnet/framework/wcf/feature-details/working-with-certificates). |