Password Depot Enterprise Server supports several authentication types (among others Standard Authentication, Integrated Windows Authentication/Single Sign On, Windows Domain Credentials, Entra ID, OpenID Connect, and Passkeys). The Web Client 1.0 (Legacy) – the 1.x release series – uses only a subset of them. This article summarizes what works in Web Client 1.x – and what you need Web Client 2.0 for.
Supported: login with username and password
Web Client 1.x offers only the classic login form with username and password (Standard Authentication). Requirements in the Server Manager under Manage → Server settings → Connections: under Supported authentications, Standard Authentication must be enabled; under Supported clients, the Web Client option.
Users imported from Active Directory log in via the same form using their Windows credentials. Use the full login name in UPN format (user@company.local) or as COMPANY\user – as of server version 18.0.7, the server strictly validates AD login names (setting ADStrictNaming, enabled by default).
Not supported: OIDC, Entra ID, Windows SSO, Passkeys
Logging in via OpenID Connect (OIDC) or Entra ID does not work in Web Client 1.x – this is a known limitation of all 1.x versions up to and including the latest releases (e.g. 1.6 with Entra ID). Typical symptoms are a 401 error after signing in at the identity provider or a failed or aborted redirect back to the web client. A fix for 1.x is not planned.
These methods only become available with the Web Client 2.0 (requires Enterprise Server 19.1.0 or later): Standard, SSPI (domain credentials), Windows SSO (Negotiate), Passkeys (WebAuthn), OpenID Connect, and Entra ID.
Two-factor authentication (2FA/TOTP)
Two-factor authentication is supported in Web Client 1.x: with 2FA enabled (operation mode TOTP), the web client prompts for the 6-digit code from the authenticator app; the initial setup is done via QR code. Note two particularities:
Code required at every login: The REST interface does not support "trusted devices" – unlike in the Windows client, users must enter the code in the web client at every login.
Code is rejected: TOTP codes are time-based. First check whether the system time of the server and of the device running the authenticator app are in sync (time synchronization/NTP). If that does not help, the administrator can reset the user's 2FA: Server Manager, Users area → select the user → Reset 2FA. This generates a new secret key and deletes all trusted devices; the user scans the new QR code at the next login.
Note: Web Client 1.0 is no longer being developed; until the end of support on December 31, 2026, AceBIT provides critical security fixes only. If you need OIDC/Entra ID, Windows SSO, or Passkeys in the browser, migrate to Web Client 2.0 (Enterprise Server 19.1.0 or later).
Related topics:
Web Client 1.0 vs. 2.0: Differences and Migration
Web Client 1.x no longer works after a server update
Which authentication methods does the Web Client 2.0 support?
How is Two-Factor Authentication (2FA) implemented in Password Depot and which settings are required to activate it? (205520898)