Breadcrumbs

SSO Break Glass Procedure

Last Updated: October 23, 2026

Overview

This procedure turns off single sign-on (SSO) for your D3 accounts when your identity provider becomes unavailable, so that users can sign in with a D3 password instead.

Procedure

Preliminary Step

  1. Provide D3 with a list of your organization's authorized users who are permitted to request the disabling of SSO. These users must also have a role with the Administrator access type.

SSO Break Glass Procedure

  1. Contact D3 to request a change in login method from SSO to General Authentication for an account, providing the username of an authorized user.

  2. After D3 tells you that the login method has been changed, enter that username on the D3 sign-in page and select Continue.

    The D3 sign-in page with the Username box

  3. Enter your D3 password (not your SSO password) and select Sign In, then go to step 8. If you do not know the password, select Forgot password?.

    02-password.png

  4. On the Forgot Password? page, check that the account shown is yours, then select Send Reset Link. The reset link is sent to the email address of the account.

    03-forgot-password.png

  5. Check the email of the account for the reset instructions, and select Reset Password or the link in the email to open the password reset page.

    att_4_for_280592463.png

    att_10_for_280592463.png

  6. Enter a new password that meets all the requirements on the password reset page, then select Submit. You are returned to the sign-in page.

    att_5_for_280592463.png

  7. Sign in with the username and the password you just set.

  8. Go to Global Settings > Application Settings, and select Login Authentication (under Security & Authentication).

  9. If no specific sites or users have their own login method, set Default Login Method, on the Certificate tab, to General Authentication, then select Save at the top of the panel. All users then sign in with General Authentication.

    The Default Login Method list open on the Certificate tab

    The Save and Cancel buttons that appear at the top of the Login Authentication panel after a change

  10. If specific sites or users use an SSO login method, switch each of them to General Authentication: on the Site tab, choose the site's Login Method, and on the User tab, choose the user's Login Method. Then select Save.

    The Site tab with a site's Login Method list open

    The User tab with a user's Login Method list open

After the changes are saved, users can sign in with General Authentication. A user who does not know their D3 password must reset it.

READER NOTE

The Forgot password? link is shown only while the Web Config key EnableSelfServiceAccountRecovery is True (Global Settings > Application Settings > Web Config). When it is False, an administrator must unlock the account or reset the password instead.