Authentication Modes
Each organization selects how its users sign in. The mode determines where credentials are validated and how identities map to WebStream users and groups.
Available modes
| Mode | Use it when |
|---|---|
| Built-in | You want WebStream to manage local accounts and passwords. Simplest for a PoC. |
| OIDC | You use an enterprise identity provider (Azure AD/Entra, Okta, Google Workspace) and want single sign-on with claim mapping. |
| LDAP | You authenticate against an existing directory such as Active Directory. |
| Workgroup | You map to local Windows accounts on the session host without a central directory. |
Choosing a mode
For evaluation, Built-in is the fastest path. For production, prefer OIDC or LDAP so identity, lifecycle, and multi-factor policies stay with your existing provider. The detailed configuration for each mode lives in the Identity & SSO section.
Note
The authentication mode is set per organization, so different tenants can use different providers within the same deployment.