Directories, single sign-on, MFA, privileged and contractor access, shift workers: what to check before you choose, with a criteria grid.
Six questions identity tools answer in a terminal
The directory of the 1990s, often LDAP, is still the heart of most terminals. Around it, newer tools add single sign-on, phishing-resistant authentication and controlled access for vendors. This page is for the IT managers and CIOs who choose or review those tools. It names no product as the best one: it gives the questions to ask, 29 criteria in seven families, each tied to a public, dated text, and a grid to compare your own shortlist.
Directory
Single sign-on
Multi-factor authentication
Privileged access
Contractors and vendors
Gate and yard
Seven families of criteria
The criteria come from the US Coast Guard cyber rule (33 CFR 101.650), the IMO cyber guidelines (Rev.4), NIS2 Article 21, NIST SP 800-63B-4 and SP 800-207, the CISA fact sheet on phishing-resistant MFA, the CISA and NSA identity guide for administrators, and the NSA and CISA top ten misconfigurations. Open the criteria below for the question, the reason and what to ask to see.
D · Directory · 4 criteria
S · Single sign-on and federation · 4 criteria
M · Multi-factor authentication · 4 criteria
P · Privileged access · 4 criteria
J · Joiners, movers, leavers · 5 criteria
G · Gate, yard and shared terminals · 4 criteria
R · Running it · 4 criteria
The 29 criteria and what to ask to see
Click a criterion to read the question for the publisher, why it matters, and what to see in a demonstration.
Ask the publisher
Can the tool be the one directory for staff, contractors and vendor engineers, or read them from the directory you already have (for example over LDAP or from the HR system), without a second list kept by hand?
Why
IMO Rev.4 asks for unique credentials for all users (3.5.3.1). The CISA and NSA IAM guide for administrators (March 2023) starts with identity governance: knowing every identity and who is responsible for it. Two lists kept by hand drift apart, and the leaver stays in one of them.
Ask to see
- Where each kind of user (staff, contractor, vendor) is created, shown in the demonstration
- What happens in the tool when a person is removed from the source directory
Sources: IMO, MSC-FAL.1/Circ.3/Rev.4, Guidelines on maritime cyber risk management (28 May 2026) · CISA and NSA (Enduring Security Framework), Identity and Access Management Recommended Best Practices Guide for Administrators (21 March 2023)
Ask the publisher
Can access be given by role (gate clerk, planner, crane technician, TOS administrator, vendor support) rather than person by person, and can one person hold a role for a limited time?
Why
33 CFR 101.650(a)(5) requires least privilege for administrator and other privileged accounts. NIS2 Art. 21(2)(i) lists access control policies among the measures every essential or important entity takes. Roles are how least privilege stays true when people change shifts and roles.
Ask to see
- The role list configured for a test site, with the rights of each role
- A role given with an end date, and what happens on that date
Sources: eCFR, 33 CFR 101.650, Cybersecurity measures (US Coast Guard rule) (in force since 16 July 2025, read on 11 November 2026) · Directive (EU) 2022/2555 (NIS2), Article 21(2) (14 December 2022)
Ask the publisher
Can you export, at any time, the list of accounts with their roles, their last logon and their end date, in a format a spreadsheet opens?
Why
33 CFR 101.650(b)(3) requires an accurate inventory of network-connected systems; the people who can reach them are part of that picture. The NSA/CISA advisory AA23-278A lists poor credential hygiene (misconfiguration 9). An access review starts from that export.
Ask to see
- An export from the test site, opened in a spreadsheet
- The fields it holds (last logon, end date, role, sponsor)
Sources: eCFR, 33 CFR 101.650, Cybersecurity measures (US Coast Guard rule) (in force since 16 July 2025, read on 11 November 2026) · NSA and CISA, advisory AA23-278A, Top Ten Cybersecurity Misconfigurations (5 October 2023)
Ask the publisher
Are lockout after repeated failures, password strength and the change of initial passwords set once in the tool and applied to every application behind it?
Why
33 CFR 101.650(a)(1) to (a)(3) require automatic lockout after repeated failed logins, default passwords changed before use, and a minimum password strength. AA23-278A puts default configurations first in its list.
Ask to see
- The lockout and password settings page
- What a new account must do at its first logon
Sources: eCFR, 33 CFR 101.650, Cybersecurity measures (US Coast Guard rule) (in force since 16 July 2025, read on 11 November 2026) · NSA and CISA, advisory AA23-278A, Top Ten Cybersecurity Misconfigurations (5 October 2023)
Ask the publisher
Which standards does the tool speak to applications: OpenID Connect, OAuth 2.0, SAML 2.0, LDAP, Kerberos? Which of your applications (TOS client, gate system, mail, maintenance software, portals) speak one of them?
Why
The CISA and NSA IAM guide for administrators (March 2023) covers identity federation and single sign-on as one of its five areas. With open standards, an account closed in one place is closed for every application behind it, and the terminal can change tool later.
Ask to see
- The list of protocols in the documentation
- Your own list of applications, each marked with the standard it supports, or « none »
Ask the publisher
For the old applications that only have their own user list (some TOS clients, OCR consoles, crane maintenance tools), what does the tool offer: account sync, a gateway in front of the application, or nothing?
Why
An application outside single sign-on keeps its own accounts, and its leavers are the ones forgotten. 33 CFR 101.650(a)(7) requires credentials removed or revoked when a user leaves the organisation, in every system.
Ask to see
- The answer for each of your applications that has no standard
- The written procedure for the ones that stay outside
Ask the publisher
Can session length and idle timeout be set per application, and can an administrator end all sessions of one person at once?
Why
NIST SP 800-207 (zero trust) grants access to each resource per session (tenet 3). When a badge is lost or a person is dismissed, ending every open session matters as much as disabling the account.
Ask to see
- The session settings per application
- « End all sessions » for one test user, shown in the demonstration
Sources: NIST SP 800-207, Zero Trust Architecture (August 2020)
Ask the publisher
Can staff of a partner (shipping line, haulier, customs broker) log in with their own company account through federation, with the terminal still deciding what they may see?
Why
The CISA and NSA IAM guide covers identity federation. Federation removes shared partner accounts, but only if the terminal keeps the rights on its side and can cut one partner off.
Ask to see
- A federated test partner, its rights, and how it is cut off
Ask the publisher
Can the tool ask for a second factor on every password-protected application and every remote access, and record the exceptions with their compensating control?
Why
33 CFR 101.650(a)(4) requires multi-factor authentication on password-protected IT and on remotely accessible OT, with documented compensating controls where it is not feasible. NIS2 Art. 21(2)(j) names multi-factor or continuous authentication. IMO Rev.4 asks for it in 3.5.3.2.
Ask to see
- The policy that decides when the second factor is asked
- Where exceptions and their compensating control are written
Sources: eCFR, 33 CFR 101.650, Cybersecurity measures (US Coast Guard rule) (in force since 16 July 2025, read on 11 November 2026) · Directive (EU) 2022/2555 (NIS2), Article 21(2) (14 December 2022) · IMO, MSC-FAL.1/Circ.3/Rev.4, Guidelines on maritime cyber risk management (28 May 2026)
Ask the publisher
Does the tool support phishing-resistant authenticators: FIDO2/WebAuthn security keys and passkeys, or smart cards (PKI)? Can they be required for administrators and remote access?
Why
CISA's fact sheet (October 2022) names FIDO/WebAuthn and PKI-based authentication as phishing-resistant and urges them as a high priority. NIST SP 800-63B-4 requires phishing resistance at AAL3 and requires verifiers to offer a phishing-resistant option at AAL2 (section 3.2.5 defines it).
Ask to see
- A logon with a security key or a passkey, shown
- The policy that requires it for the administrator role
Sources: CISA, Implementing Phishing-Resistant MFA (fact sheet) (October 2022) · NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management (July 2025)
Ask the publisher
If push notifications or codes are kept for some users, does the tool offer number matching, limit repeated push requests, and let you switch off SMS and voice codes?
Why
CISA's fact sheet describes push bombing and SIM swap attacks and recommends number matching where factors are not phishing-resistant. NIST SP 800-63B-4 marks authentication over the public telephone network as restricted (3.1.3.3). AA23-278A lists weak or misconfigured MFA methods as misconfiguration 7.
Ask to see
- The factor settings page, with SMS and voice switched off
- What a user sees after several refused push requests
Sources: CISA, Implementing Phishing-Resistant MFA (fact sheet) (October 2022) · NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management (July 2025) · NSA and CISA, advisory AA23-278A, Top Ten Cybersecurity Misconfigurations (5 October 2023)
Ask the publisher
When a worker loses a key or a phone during a night shift, how do they get back in, and who checks it is really them before a new factor is registered?
Why
A recovery path that only needs a phone call to the help desk undoes the second factor. The CISA and NSA IAM guide covers MFA and the hardening of the processes around it.
Ask to see
- The written recovery procedure, with who approves it out of office hours
- A recovery shown for a test user
Ask the publisher
Can administrators have a separate, named admin identity, with its own stronger rules, kept apart from the account they use for mail and the web?
Why
33 CFR 101.650(a)(6) asks that users keep separate credentials on critical IT and OT systems. AA23-278A names improper separation of user and administrator privilege as misconfiguration 2.
Ask to see
- A test administrator with two identities, and the rules on each
Sources: eCFR, 33 CFR 101.650, Cybersecurity measures (US Coast Guard rule) (in force since 16 July 2025, read on 11 November 2026) · NSA and CISA, advisory AA23-278A, Top Ten Cybersecurity Misconfigurations (5 October 2023)
Ask the publisher
Can administrator rights be requested, approved and granted for a stated job and a limited time, then removed automatically?
Why
33 CFR 101.650(a)(5) requires least privilege for administrator and other privileged accounts. Rights that are only there during the job cannot be used the rest of the year.
Ask to see
- A request, its approval and the automatic removal, shown
- The record of who held which right and when
Ask the publisher
Can vendor and support engineers reach the TOS servers, crane systems or gate servers only through one gateway that checks their identity and second factor and records the session?
Why
33 CFR 101.650(f)(3) requires the owner or operator to monitor and document all third-party remote connections. The CISA-led Guide to Securing Remote Access Software (June 2023) recommends knowing and allowlisting the remote access tools in use.
Ask to see
- A vendor session through the gateway, and its record
- How long session records are kept, and who reads them
Sources: eCFR, 33 CFR 101.650, Cybersecurity measures (US Coast Guard rule) (in force since 16 July 2025, read on 11 November 2026) · CISA, NSA, FBI, MS-ISAC and INCD, Guide to Securing Remote Access Software (6 June 2023)
Ask the publisher
Where a system only has one built-in admin password (a switch, a PLC engineering station, a database), can the tool keep it in a vault, show who took it, and change it after use?
Why
AA23-278A lists poor credential hygiene (misconfiguration 9). IMO Rev.4 asks for unique credentials (3.5.3.1): where a device cannot have them, knowing who used the shared one is the next best thing.
Ask to see
- The vault entry of a test device, with its check-out history
- The password change after check-in, shown
Sources: NSA and CISA, advisory AA23-278A, Top Ten Cybersecurity Misconfigurations (5 October 2023) · IMO, MSC-FAL.1/Circ.3/Rev.4, Guidelines on maritime cyber risk management (28 May 2026)
Ask the publisher
Can every contractor or vendor account carry a sponsor inside the terminal and an end date, and is it disabled on that date unless the sponsor renews it?
Why
33 CFR 101.650(a)(7) requires credentials removed or revoked when a user leaves the organisation. A contractor rarely « leaves » in the HR system: the end date is the only reliable trigger.
Ask to see
- A contractor account with sponsor and end date
- What the sponsor receives before the end date
Ask the publisher
When a person leaves, does one action disable the directory account, end open sessions, revoke registered factors and flag the accounts in applications outside single sign-on?
Why
33 CFR 101.650(a)(7) requires credentials removed or revoked on leaving. The CISA-led remote access guide recommends auditing the directory for inactive and obsolete accounts.
Ask to see
- The leaver action on a test user, and what it changed
- The list of applications it does not reach
Sources: eCFR, 33 CFR 101.650, Cybersecurity measures (US Coast Guard rule) (in force since 16 July 2025, read on 11 November 2026) · CISA, NSA, FBI, MS-ISAC and INCD, Guide to Securing Remote Access Software (6 June 2023)
Ask the publisher
When a gate clerk becomes a planner, or a technician moves to another site, are the rights of the old role removed when the new one is given?
Why
33 CFR 101.650(a)(5) requires least privilege. Rights that pile up with each move are a quiet breach of it, and a gift to anyone who takes over that account.
Ask to see
- A role change on a test user, before and after
Ask the publisher
Can the tool send each manager or sponsor the list of their people's access to confirm or remove, and keep the answers?
Why
NIS2 Art. 21(2)(i) lists human resources security and access control policies. The CISA and NSA IAM guide puts identity governance and IAM auditing among its five areas. A review with a written answer is evidence.
Ask to see
- A review campaign on the test site, and its result file
Sources: Directive (EU) 2022/2555 (NIS2), Article 21(2) (14 December 2022) · CISA and NSA (Enduring Security Framework), Identity and Access Management Recommended Best Practices Guide for Administrators (21 March 2023)
Ask the publisher
Does the tool list accounts that have not logged in for a set number of days, and can it disable them automatically?
Why
The CISA-led remote access guide recommends auditing for inactive and obsolete accounts. AA23-278A lists poor credential hygiene (misconfiguration 9).
Ask to see
- The inactive-account report on the test site
Sources: CISA, NSA, FBI, MS-ISAC and INCD, Guide to Securing Remote Access Software (6 June 2023) · NSA and CISA, advisory AA23-278A, Top Ten Cybersecurity Misconfigurations (5 October 2023)
Ask the publisher
On a gate lane PC, a yard tablet or a control-room console used by several people per day, does each worker log in as themselves, or is there one shared account?
Why
IMO Rev.4 asks for unique credentials for all users (3.5.3.1). A shared account cannot be closed for one leaver and does not say who did what at the gate.
Ask to see
- The list of shared screens and the account each one uses today
- How the tool handles several users on one device, shown
Sources: IMO, MSC-FAL.1/Circ.3/Rev.4, Guidelines on maritime cyber risk management (28 May 2026)
Ask the publisher
How long does it take one worker to leave a shared screen and the next one to log in, with the second factor, wearing gloves? Can a badge tap plus a PIN do it?
Why
A logon that slows a lane at shift change gets bypassed: the screen stays logged in. NIST SP 800-207 grants access per session (tenet 3): the switch must be fast enough to be used every time.
Ask to see
- The switch timed on a real shared screen, at shift change, by the people who use it
Sources: NIST SP 800-207, Zero Trust Architecture (August 2020)
Ask the publisher
Can shared screens lock after a short idle time, and close the session when a worker walks away, without losing the work of the next one?
Why
NIST SP 800-207 grants access per session (tenet 3). An unlocked lane PC is an open session for whoever stands in front of it.
Ask to see
- The idle lock setting for shared screens, shown on a device
Sources: NIST SP 800-207, Zero Trust Architecture (August 2020)
Ask the publisher
If the link to a cloud identity service or to the head office is down, can gate and yard staff still log in, and for how long? What is the documented fallback?
Why
The gate works around the clock. 33 CFR 101.650(a)(4) allows documented compensating controls where multi-factor authentication is not feasible: a link outage is the case to plan in writing, not at 3 a.m.
Ask to see
- The publisher's documented behaviour when the identity service is unreachable
- Your written fallback for the gate and the yard
Ask the publisher
Is the tool a cloud service, software you host, or both? Who operates it, who patches it, in which country is the data held?
Why
NIS2 Art. 21(2)(d) covers supply chain security, including the security aspects of the relationship with each direct supplier. The identity system becomes one of the most critical suppliers of the terminal.
Ask to see
- The hosting options and data locations in the documentation
- Who patches it, and how fast, in writing
Sources: Directive (EU) 2022/2555 (NIS2), Article 21(2) (14 December 2022)
Ask the publisher
Does the tool log logons, failures, factor changes, role changes and administrator actions, and send them to your log store or SIEM in a documented format?
Why
33 CFR 101.650(c)(1) requires logs to be securely captured, stored and protected. The CISA and NSA IAM guide names IAM auditing and monitoring as one of its five areas.
Ask to see
- A sample of the log lines for a logon and a role change
- The forwarding settings to your SIEM
Sources: eCFR, 33 CFR 101.650, Cybersecurity measures (US Coast Guard rule) (in force since 16 July 2025, read on 11 November 2026) · CISA and NSA (Enduring Security Framework), Identity and Access Management Recommended Best Practices Guide for Administrators (21 March 2023)
Ask the publisher
How are the tool's own administrators protected (phishing-resistant factor, separate accounts), and how is a compromise of the tool detected?
Why
Whoever controls the identity system controls every account behind it. The CISA and NSA IAM guide covers environmental hardening of the identity infrastructure.
Ask to see
- The admin accounts of the tool and their factors
- The alerts on changes to its configuration
Ask the publisher
Can users, groups, roles and configuration be exported in a documented format, so the terminal can change tool or host later? Under which licence is the software published?
Why
Open standards (line S1) and a full export keep the terminal free to change. The licence decides what you may run, change and redistribute: read it before you build on the tool.
Ask to see
- A full export from the test site
- The licence text, read
Sources: Licence of the software · line S1
Tool categories, with open-source examples
Examples only: public open-source projects, in alphabetical order inside each category, described in their publisher's own words, with the licence their repository declares (read on 11 November 2026). This is not a ranking, a recommendation or a test, and commercial products exist in every category. Put the tools you are considering in the grid, whatever their origin.
Hold the list of people and groups that other systems trust, usually over LDAP or Kerberos. The « LDAP » of the 1990s is still here, often behind a newer layer.
- FreeIPA: « Identity, Policy, Audit »: manage Linux users and client hosts in your realm from one central location (licence: GPL-3.0)
- lldap: « Light LDAP implementation » (licence: GPL-3.0)
- OpenLDAP: « an open source implementation of the Lightweight Directory Access Protocol » (licence: OpenLDAP Public License (see the project))
- Samba: an open source implementation of the SMB and Active Directory protocols for Linux and UNIX-like systems (licence: GPL-3.0)
Give one logon to many applications over OpenID Connect, OAuth 2.0 or SAML, often with multi-factor authentication built in.
- authentik: « The authentication glue you need. » (licence: see the repository's licence file)
- Authelia: « The Single Sign-On Multi-Factor portal for web apps. » (licence: Apache-2.0)
- Keycloak: « Open Source Identity and Access Management For Modern Applications and Services » (licence: Apache-2.0)
- Logto: « Authentication and authorization infrastructure for SaaS and AI apps, built on OIDC and OAuth 2.1 with multi-tenancy, SSO, and RBAC. » (licence: MPL-2.0)
- Ory Hydra and Ory Kratos: Hydra: « OpenID Certified™ OpenID Connect and OAuth2.1 provider that integrates with your user management through headless APIs »; Kratos: « Headless cloud-native authentication and identity management » (licence: Apache-2.0)
- ZITADEL: « Identity infrastructure, simplified for you. » (licence: AGPL-3.0)
Put one controlled, recorded path in front of servers and consoles for administrators and vendor engineers.
- Apache Guacamole: « a clientless remote desktop gateway. It supports standard protocols like VNC, RDP, and SSH. » (licence: Apache-2.0)
- JumpServer: « an Open-source Privileged Access Management (PAM) platform » (licence: GPL-3.0)
Not a product but a family of standards: FIDO2/WebAuthn security keys and passkeys, and smart cards (PKI). Check that the identity provider, the browsers and the shared screens of the terminal all support the one you choose.
What the public sources say
Every criterion names its paragraph. We quote only public texts and give their date; we name no terminal and no client.
Download the criteria grid
One grid, two formats. Version 1.0, published 11 November 2026. Write the weight of each line before the first demonstration, then shown, documented, partial or no for each tool. There is no total: read the « must » lines first.
Identity and access tools: questions
Click a question to read the answer.
It is what decides who is who, what each person may open and how they prove it: the directory, single sign-on, multi-factor authentication, privileged access, and the arrival, change and departure of people. In a terminal it covers office staff, but also gate and yard shift workers on shared screens, contractors, vendor engineers who support the terminal operating system and the cranes, and partners whose systems call the terminal's interfaces.
No. Many directories still speak LDAP, and many older applications only speak LDAP. Newer identity providers often sit in front of a directory and add single sign-on over OpenID Connect or SAML, and multi-factor authentication. The question to ask is not old or new, but whether a leaver loses every access the same day.
A second factor that a fake login page cannot capture and replay. CISA's fact sheet of October 2022 names FIDO2 and WebAuthn security keys or passkeys, and smart cards based on PKI. NIST SP 800-63B-4 (July 2025) requires it at its highest assurance level and requires services to offer it at the middle one. Codes by SMS, codes from an app and push notifications are better than no second factor, but they can be phished.
Yes, if the switch between workers is fast enough to be used every time. Ask the publisher to time it on a real shared screen at shift change, with gloves, for example with a badge tap and a PIN. A logon that slows a lane gets bypassed and the screen stays logged in. Lines G1 to G4 of the grid cover this.
Both can work. A cloud service removes patching from your team but adds a dependency on the link and on the supplier; a hosted tool keeps working on site but your team must patch and protect it. Ask what happens at the gate when the link is down (line G4), who patches and how fast (R1), and how you would leave (R4).
Because the right tool depends on your applications, your vendors and your gate, and because prices and editions change. The page names open-source examples in alphabetical order, in their publisher's own words, and gives a grid to compare the tools on your own shortlist, commercial or open source. Port Cyber Alliance does not certify tools.
Related pages
A short assessment for IT and terminal managers, in your browser. You get a score, your weak spots and a PDF.
Want to know where your team stands?