# Is there a way to change SAML authentication to local authentication from a configuration file in Dynatrace? **URL:** \ **Category:** Open Q&A\ **Tags:** sso\ **Created:** [May 7, 2019, 8:05pm UTC](https://community.dynatrace.com/t/is-there-a-way-to-change-saml-authentication-to-local-authentication-from-a-configuration-file-in-dynatrace/20580 "2019-05-07T20:05:38Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![james\_mayers](https://avatars.discourse-cdn.com/v4/letter/j/ecb155/32.png) [@james\_mayers](https://community.dynatrace.com/u/james_mayers)\ **Post date:** [May 7, 2019, 8:05pm UTC](https://community.dynatrace.com/t/is-there-a-way-to-change-saml-authentication-to-local-authentication-from-a-configuration-file-in-dynatrace/20580/1 "2019-05-07T20:05:38Z")
Is there a way to change SAML authentication to local authentication from a configuration file in Dynatrace? ---
**Author:** ![gerald\_1](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/gerald_1/32/18514_2.png) [@gerald\_1](https://community.dynatrace.com/u/gerald_1)\ **Post date:** [May 8, 2019, 8:08am UTC](https://community.dynatrace.com/t/is-there-a-way-to-change-saml-authentication-to-local-authentication-from-a-configuration-file-in-dynatrace/20580/2 "2019-05-08T08:08:12Z")
Hello, you can disable it with a switch in the UI. Not via config file. See [https://www.dynatrace.com/support/help/how-to-use…](https://www.dynatrace.com/support/help/how-to-use-dynatrace/data-privacy-and-security/configuration/manage-users-and-groups-with-saml/) Gerald ---
**Author:** ![james\_mayers](https://avatars.discourse-cdn.com/v4/letter/j/ecb155/32.png) [@james\_mayers](https://community.dynatrace.com/u/james_mayers)\ **Post date:** [May 8, 2019, 3:24pm UTC](https://community.dynatrace.com/t/is-there-a-way-to-change-saml-authentication-to-local-authentication-from-a-configuration-file-in-dynatrace/20580/3 "2019-05-08T15:24:02Z")
So, if something went wrong with SAML, and user are not able to login to the UI, there isn’t away to switch the authentication back from a config file ? ---
**Author:** ![Enrico\_F](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/enrico_f/32/23774_2.png) [@Enrico\_F](https://community.dynatrace.com/u/Enrico_F)\ **Post date:** [May 9, 2019, 6:43am UTC](https://community.dynatrace.com/t/is-there-a-way-to-change-saml-authentication-to-local-authentication-from-a-configuration-file-in-dynatrace/20580/4 "2019-05-09T06:43:42Z")
I raised a [support ticket](https://support.dynatrace.com/supportportal/browse/DTONE-15521?_ga=2.128221516.1764261608.1557129673-1388494667.1539072555) for exactly this problem over a month ago but never received a useful answer (case is still open). ---
**Author:** ![gerald\_1](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/gerald_1/32/18514_2.png) [@gerald\_1](https://community.dynatrace.com/u/gerald_1)\ **Post date:** [May 9, 2019, 6:48am UTC](https://community.dynatrace.com/t/is-there-a-way-to-change-saml-authentication-to-local-authentication-from-a-configuration-file-in-dynatrace/20580/5 "2019-05-09T06:48:21Z")
Hello, the doc says to use a non-federated user so that you can change it in case something goes wrong. Gerald ---
**Author:** ![Enrico\_F](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/enrico_f/32/23774_2.png) [@Enrico\_F](https://community.dynatrace.com/u/Enrico_F)\ **Post date:** [May 9, 2019, 7:02am UTC](https://community.dynatrace.com/t/is-there-a-way-to-change-saml-authentication-to-local-authentication-from-a-configuration-file-in-dynatrace/20580/6 "2019-05-09T07:02:57Z")
Curiously, how would I be able to log on using a non-federated user if “SSO” was selected in the CMC under “Home \> Users \> Single sign on settings” (effectively disabling the login mask) and there was a failure with the SAML authentication service? Besides, I don’t see an option for inviting users on our Dynatrace Manage instance (as suggested in the [doc](https://www.dynatrace.com/support/help/shortlink/manage-users-groups-with-saml#saml-federated-idp-configuration)). Is this an exclusive SaaS feature? ---
**Author:** ![Radoslaw\_Szulgo](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/radoslaw_szulgo/32/1977_2.png) [@Radoslaw\_Szulgo](https://community.dynatrace.com/u/Radoslaw_Szulgo)\ **Post date:** [May 15, 2019, 8:36pm UTC](https://community.dynatrace.com/t/is-there-a-way-to-change-saml-authentication-to-local-authentication-from-a-configuration-file-in-dynatrace/20580/7 "2019-05-15T20:36:33Z")
As a title says - this doc page refers to SaaS. For Managed you can only use embedded ‘admin’ account to bypass SSO. Unless you have configured “SSO only”. If that is the case - the only option is to use REST API call to change authentication method or Create a support ticket so we can reset your configuration. ---
**Author:** ![kevin\_kendall](https://avatars.discourse-cdn.com/v4/letter/k/dec6dc/32.png) [@kevin\_kendall](https://community.dynatrace.com/u/kevin_kendall)\ **Post date:** [June 6, 2019, 12:32pm UTC](https://community.dynatrace.com/t/is-there-a-way-to-change-saml-authentication-to-local-authentication-from-a-configuration-file-in-dynatrace/20580/8 "2019-06-06T12:32:42Z")
Can you share the API call needed to perform this change in authentication method? I’m hesitant to utilize SSO until we have a way to get back into the system if the SAML service is broken. Having an API call to switch it would work. ---
**Author:** ![Enrico\_F](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/enrico_f/32/23774_2.png) [@Enrico\_F](https://community.dynatrace.com/u/Enrico_F)\ **Post date:** [June 6, 2019, 3:21pm UTC](https://community.dynatrace.com/t/is-there-a-way-to-change-saml-authentication-to-local-authentication-from-a-configuration-file-in-dynatrace/20580/9 "2019-06-06T15:21:40Z")
That would be calling ```auto /api/v1/onpremise/userRepository/authenticationMode ``` on the Cluster Management API with the following JSON content body in a POST request: ```auto { "authenticationProvider": "INTERNAL" } ``` To revert back to SSO you can do the same with: ```auto { "authenticationProvider": "LDAP" } ``` HTH ---
**Author:** ![kevin\_kendall](https://avatars.discourse-cdn.com/v4/letter/k/dec6dc/32.png) [@kevin\_kendall](https://community.dynatrace.com/u/kevin_kendall)\ **Post date:** [June 10, 2019, 5:22pm UTC](https://community.dynatrace.com/t/is-there-a-way-to-change-saml-authentication-to-local-authentication-from-a-configuration-file-in-dynatrace/20580/10 "2019-06-10T17:22:39Z")
So I tried this and it did not work as expected. The issue is actually around the “Select login page”. When I change this to SSO only so that the users are directed to SSO, I’m not seeing a way to change this back to a login prompt in case SAML SSO is unavailable. I tried using the API commands above but no matter if it’s set to Internal or LDAP, if I had set the login page to use SSO only, it continues to redirect to the SAML provider. Is there a different API call that will allow me to change the Login Page? This is the real crux of my issue. ---
**Author:** ![Radoslaw\_Szulgo](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/radoslaw_szulgo/32/1977_2.png) [@Radoslaw\_Szulgo](https://community.dynatrace.com/u/Radoslaw_Szulgo)\ **Post date:** [June 10, 2019, 7:29pm UTC](https://community.dynatrace.com/t/is-there-a-way-to-change-saml-authentication-to-local-authentication-from-a-configuration-file-in-dynatrace/20580/11 "2019-06-10T19:29:46Z")
1. To get the current configuration: ```auto GET /api/v1/onpremise/sso/ssoProvider ``` Example: ```auto curl -X GET "https:///api/v1.0/onpremise/sso/ssoProvider?Api-Token=" -H "accept: application/json" ``` 2. To update config: ```auto POST /api/v1.0/onpremise/sso/ssoProvider ``` Example: ```auto curl -X POST "https:///api/v1.0/onpremise/sso/ssoProvider?Api-Token=" -H "accept: application/json" -H "Content-Type: application/json" ``` And payload: ```auto {"ssoProvider":"NONE","loginPage":"STANDARD","ssoEnabled":false,"ssoGroupsEnabled":false,"ssoLoginDisabled":true} ``` ---
**Author:** ![kevin\_kendall](https://avatars.discourse-cdn.com/v4/letter/k/dec6dc/32.png) [@kevin\_kendall](https://community.dynatrace.com/u/kevin_kendall)\ **Post date:** [June 10, 2019, 8:24pm UTC](https://community.dynatrace.com/t/is-there-a-way-to-change-saml-authentication-to-local-authentication-from-a-configuration-file-in-dynatrace/20580/12 "2019-06-10T20:24:13Z")
That looks promising, however on my system (version 1.168), I’m receiving an HTTP 404 for that API function. I also don’t see it listed under the Cluster API page. What version is required for this functionality? This is EXACTLY what I’m looking for so I’m glad it appears that it exists and is coming. ---
**Author:** ![Radoslaw\_Szulgo](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/radoslaw_szulgo/32/1977_2.png) [@Radoslaw\_Szulgo](https://community.dynatrace.com/u/Radoslaw_Szulgo)\ **Post date:** [June 11, 2019, 8:03am UTC](https://community.dynatrace.com/t/is-there-a-way-to-change-saml-authentication-to-local-authentication-from-a-configuration-file-in-dynatrace/20580/13 "2019-06-11T08:03:07Z")
sorry - misspellig. My answer updated ---
**Author:** ![kevin\_kendall](https://avatars.discourse-cdn.com/v4/letter/k/dec6dc/32.png) [@kevin\_kendall](https://community.dynatrace.com/u/kevin_kendall)\ **Post date:** [June 11, 2019, 1:25pm UTC](https://community.dynatrace.com/t/is-there-a-way-to-change-saml-authentication-to-local-authentication-from-a-configuration-file-in-dynatrace/20580/14 "2019-06-11T13:25:09Z")
I didn’t catch the v1 versus v1.0. This works perfectly! I can now comfortably move to SSO login knowing that we can revert if needed. Thanks so much. ---
**Author:** ![Enrico\_F](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/enrico_f/32/23774_2.png) [@Enrico\_F](https://community.dynatrace.com/u/Enrico_F)\ **Post date:** [November 21, 2019, 7:42am UTC](https://community.dynatrace.com/t/is-there-a-way-to-change-saml-authentication-to-local-authentication-from-a-configuration-file-in-dynatrace/20580/15 "2019-11-21T07:42:17Z")
It seems this is now possible using the /admin backdoor. > **[Login | Dynatrace](https://sso.dynatrace.com/action/signin?goto=https%3A%2F%2Fsso.dynatrace.com%3A443%2Foauth2%2Fauthorize%2Fredirect%3FoAuth2CtxUuid%3D03db52cc-f05a-4997-b702-b0c5f623ede7&oAuth2RedirectUri=https%3A%2F%2Fcommunity.dynatrace.com%2Fauth%2Foauth2callback)**