---
title: Settings - Claims-based authentication
---
> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).
On this tab, you can adjust settings related to [Claims-based authentication](https://docs.kentico.com/k11/managing-users/user-registration-and-authentication/claims-based-authentication.md).
> **Note:** **Note**: You may need to [set up SSL for your site](https://docs.kentico.com/k11/securing-websites/deploying-websites-to-a-secure-environment/configuring-ssl.md) to use certain identity providers.
| General | |
| ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Enable WIF authentication | Enables claims-based authentication.
Users need to log in through the identity provider specified by the settings below (for example [Active Directory Federation Services](https://msdn.microsoft.com/en-us/library/bb897402.aspx)). Disables the standard authentication mechanisms in Kentico. |
| Identity provider URL | Specify the URL of your identity provider's **WS-Federation passive endpoint**.
You can find the value in the provider's configuration interface or WS-Federation metadata.
Example: _https://adfs.net/adfs/ls_ |
| Security realm | Enter a URI that identifies your website or application. You can use your website's **domain name** (and virtual directory if applicable) in most cases.
The value must be exactly the same as in the **relying party** configuration of your identity provider, including letter case, any trailing slashes and the protocol (http or https). |
| Allowed audience URIs | URIs of allowed audience for the identity provider, separated by semicolons. The value must match the corresponding relying party settings of your identity provider, including letter case, any trailing slashes and the protocol (http or https).
To allow the authentication for all restricted sections of your website and the Kentico administration interface, use the base domain name of the website. |
| Trusted certificate thumbprint | Enter the thumbprint of the certificate used to secure the communication between Kentico and the identity provider. You can typically find the certificate thumbprint in the provider's Key/Certificate configuration. |
| Certificate validator | Sets the validation mode used for the X.509 certificate specified in the **Trusted certificate thumbprint** setting.
**Chain trust** – accepts certificates whose chain of trust leads to a trusted certification authority. The certificate must be installed on the server hosting Kentico in the _Local Computer -> Trusted People_ certificate store.
**Peer trust** – accepts self-issued certificates. The certificate must be installed on the server hosting Kentico in the _Local Computer -> Personal_ certificate store.
**Peer or chain trust** – accepts self-issued certificates, or certificates with a chain that leads to a trusted certification authority.
**None** – no validation of the certificate is done and the system accepts any certificate with the given thumbprint.
See [Working with Certificates](https://docs.microsoft.com/en-us/dotnet/framework/wcf/feature-details/working-with-certificates). |