Press CTRL+K to open search

aaa authentication oidc web policy

  • Published on Aug 4, 2026
  • 2 minute(s) read
Prev Next

Sets the OIDC web policy on the appliance.

You can specify the following policies for using single sign-on:

  • allowed:

    SSO login is optional. The first time a user makes a Web request for a Helix appliance Web UI page, the appliance Web UI displays two login options:

    • The standard appliance local login elements (username and password fields and a Sign in button)

    • A Sign In Using Single Sign‑On button, which links to the Trellix Cloud user login page.

  • disabled:

    SSO login is not accepted for authentication. If no local session exists when a user makes a Web request for a Helix appliance Web UI, the standard local login page for the appliance appears, and the user signs in using their local credentials for that appliance.

  • required:

    SSO login is mandatory for authentication. The first time a user makes a Web request for a Helix appliance Web UI page, the Trellix Cloud user login page appears. The user signs in to their Trellix Cloud account, which was created by the IAM organization administrator. Upon successful authentication, an SSO session is established and the Alerts page of the requested Helix appliance appears.

    During subsequent requests by this user for other Helix appliance Web UI pages, the Alerts page of the requested appliance appears. The user is not prompted to log in again, provided that the SSO session has not expired.

    The user can log out of individual Helix appliances or log out of SSO altogether. When logging out of a Helix appliance, the appliance Web UI provides the option to also log out of the SSO session.

    Note

    If a SSO session is open when the user logs out of a Helix appliance only, work in the Helix Web UI can continue until the SSO session expires.

Note

System admins can log into the CLI interface using standard local authentication methods even if the OIDC Web policy is set to required.

Syntax

[no] aaa authentication oidc web policy { disabled | allowed | required }

Parameters

no

Sets the OIDC Web policy to the default (disabled) policy.

allowed

Use either OIDC authentication or local authentication methods.

disabled

Disables OIDC authentication (default)

required

Must use OIDC authentication.

Example

The following example sets the OIDC Web policy to required.

hostname (config) # aaa authentication oidc web policy required

The following example sets the OIDC Web policy to allowed.

hostname (config) # aaa authentication oidc web policy allowed

The following example sets the OIDC Web policy to disabled.

hostname (config) # aaa authentication oidc web policy disabled

The following example sets the OIDC Web policy to the default policy (disabled).

hostname (config) # no aaa authentication oidc web policy

User role

Admin

Command mode

Config

Supported appliances

  • Central Management System: Release 7.9.3

  • Endpoint Security (HX): Release 2.5

  • Network Security: Release 7.9.3

  • Intelligent Virtual Execution - Server: Release 7.9.3

Related articles