Authentication verifies that a person or application controls the credentials it presents. In Joomla, distinguish it from identification, which names the user, and authorisation, which determines permitted actions.
User login
A conventional login checks a username and password. Joomla can also use LDAP integration, persistent cookie login and other plugin-provided methods. Availability depends on the release and installed extensions.
After login, the application maintains a session. Session expiry and Remember Me are separate settings. Successful authentication does not grant permission to edit every article: Joomla groups, access levels and permissions control that.
Multi-factor verification and WebAuthn
MFA adds verification after the primary login. Methods can include TOTP codes, email confirmation and hardware devices. Check the installed release for available options. Recovery codes help regain access and should be stored separately and kept private.
WebAuthn uses cryptographic credentials bound to a website, confirmed through a device or security key. Depending on the implementation, it may support passwordless login or an additional verification step. It is not synonymous with all MFA. HTTPS and browser and device support are normally required.
API access
Applications accessing Joomla’s API may use a token. Tokens are secrets and must not appear in public content or logs. API access requires appropriate privileges, and authentication does not bypass permissions for individual operations. Basic authentication availability depends on plugins and configuration.
Preserving access
Before changing Joomla authentication plugins, verify a recovery route. Do not disable every working authentication method. Test a new method with an individual account, then check account recovery and integration compatibility.
Earlier interface illustrations
The existing Joomla 4 images below show an earlier interface. They are not an exact list of plugins in the current release.
Summary
Authentication verifies credentials, while authorisation controls actions. Joomla needs suitable login methods, additional verification and a tested recovery procedure.