User Allowlist for External Authentication Methods

If you are utilizing an external method of authentication (e.g., LDAP, Shibboleth) then you have the option of enabling the user allowlist. By default (i.e. allowlist disabled) when using external authentication methods, REDCap would normally authenticate the user and then allow them access to the application automatically, thus allowing everyone with a valid username for that external authentication to gain access to REDCap without any approval process.

Alternatively, when the allowlist is enabled, externally authenticated users will not be able to access REDCap until they have been added to the allowlist. So anyone not on the allowlist that authenticates via an external method will be given a message saying that they cannot access REDCap until an administrator adds them to the allowlist. When the allowlist is enabled, you will be given the option of automatically adding to the allowlist all users who have already accessed REDCap. All Administrators will always automatically be added the allowlist when it is enabled.

Enable the User Allowlist?

Disabled Enabled   Save     Saved!