> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/authentication/passwordless-for-web-apps/overview.md).

# Overview

<figure><img src="/files/BK310Qgum5TXMtFhFzuX" alt="User experience of Passwordless login for web apps"><figcaption></figcaption></figure>

***

### User Journey

When a user accesses a web application protected by 1Kosmos:

{% stepper %}
{% step %}
The user opens the web application.

{% endstep %}

{% step %}
The application redirects the user to 1Kosmos for authentication.

{% endstep %}

{% step %}
1Kosmos authenticates the user using one of the supported methods.

{% endstep %}

{% step %}
1Kosmos returns an authentication response (an OIDC ID token, SAML assertion, or WS-Fed token) to the web application.

{% endstep %}

{% step %}
The user is logged in to the web application.
{% endstep %}
{% endstepper %}

### 1Kosmos as Identity Provider or Service Provider

For OIDC integrations, 1Kosmos can act as either:

* **Identity Provider (IdP)** — 1Kosmos authenticates users and provides single sign-on to external web applications.
* **Service Provider (SP)** — 1Kosmos consumes authentication from another SSO solution (such as ForgeRock, Okta, IBM Tivoli Access Manager, Oracle Access Manager, or CA SiteMinder). The external IdP authenticates the user and returns an OIDC token to 1Kosmos.

For SAML integrations, 1Kosmos acts as the **Identity Provider (IdP)**, providing single sign-on to external Service Provider applications.

### Core concepts

#### User consent

Users must give explicit permission for 1Kosmos to share their profile information with relying parties. Consent grants are persisted on the 1Kosmos platform — when an application requests a new access token, the user is not re-prompted if they have already consented to the specified scopes. Consent grants remain valid until the user manually revokes them or until the user, integration, authorization server, or scope is deactivated or deleted.

#### Force re-authentication

Community administrators can require users to re-authenticate when accessing a SAML or OIDC application, regardless of whether they are already logged in with the same authentication factors. This is controlled by the **Force Re-authentication** setting on each SAML or OIDC integration. By default, this setting is disabled.

When enabled and a user opens the target application, they are redirected to the 1Kosmos Authentication page with their username pre-filled and must complete authentication again.

The following events are generated during force re-authentication:

* `E_SP_MODIFIED`
* `E_LOGIN_SUCCEEDED`
* `E_SP_REDIRECT_SUCCEEDED`

#### Where integrations are managed

All web app integrations are added and configured in **AdminX**, under **Applications → Add Application**. Existing OAuth 2.0 / OIDC community settings are viewable under **Settings → Authorization Server**.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.1kosmos.com/authentication/passwordless-for-web-apps/overview.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.