> For the complete documentation index, see [llms.txt](https://docs.nalpeiron.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nalpeiron.com/zentitle2-docs/ui-administration/configuration/account-based-licensing-identity-based-licensing.md).

# Account Based Licensing (Identity-based licensing)

Learn how Account Based Licensing activates entitlements using an end user's login credentials instead of a license key, via either OpenID Token or username/password authentication.

{% embed url="<https://youtu.be/mMbTEHFV4ms>" %}

Account Based Licensing is the process of managing users' accounts and giving users access to software or an application, typically via a username and password or an external identity management solution such as Microsoft Entra ID, Okta, OneLogin, Ping Identity, ForgeRock, Auth0, or Oracle Identity Manager.

Account—or Identity-based licensing allows you to activate an entitlement using the end user's login credentials instead of a license key, code, or activation code.

Zentitle2 supports both ways of managing access:

* Accounts created and managed in Zentitle2 use username and password authentication.
* Accounts authenticated by an external identity provider use OpenID Token authentication.

### How OpenID Token authentication works <a href="#how-openid-token-authentication-works" id="how-openid-token-authentication-works"></a>

OpenID Connect (OIDC) identity providers issue a signed JWT token after the end user signs in. Your application sends that token to Zentitle2 when it activates the license.

Zentitle2 validates the token, identifies the user, and uses the entitlement group IDs in the token to determine which entitlements the user can access. The remaining licensing flow is the same as a standard activation.

```mermaid
%%{init: {"themeVariables": {"fontSize": "18px"}, "flowchart": {"nodeSpacing": 40, "rankSpacing": 50}}}%%
flowchart TD
    user["1. End user<br/>signs in"]
    idp["2. Identity provider<br/>returns a signed JWT token"]
    app["3. Your application<br/>receives the token"]
    zentitle["4. Zentitle2 Licensing API<br/>validates the token and<br/>resolves entitlement access"]
    entitlement["5. Entitlement<br/>activated"]

    user --> idp --> app --> zentitle --> entitlement
```

### Use a tenant IdP and customer IdPs together <a href="#use-a-tenant-idp-and-customer-idps-together" id="use-a-tenant-idp-and-customer-idps-together"></a>

You can configure a tenant identity provider for your own users and also allow each customer to configure its own identity provider in the End User Portal (EUP). These configurations work together; you do not need to choose one or the other.

For EUP sign-in, Zentitle2 uses the email address entered by the end user to select the sign-in method:

* Password users continue with the Zentitle2 password sign-in.
* A configured customer IdP is used first for eligible users of that customer.
* If there is no customer IdP for the user, Zentitle2 can use the tenant IdP.

For OpenID token activation, Zentitle2 selects a customer IdP when the token issuer matches a configured customer IdP. Other tokens use the tenant IdP configuration.

### User provisioning and access <a href="#user-provisioning-and-access" id="user-provisioning-and-access"></a>

When a valid OpenID token is used for activation, Zentitle2 can automatically create or update the customer contact and OpenID user. The token supplies the user's email and name, as well as the configured user ID and entitlement group claims.

Zentitle2 synchronizes the user's entitlement group access to the group IDs in the token. This lets your identity provider remain the source of access assignments while Zentitle2 applies those assignments to the relevant entitlements.

### Next steps <a href="#next-steps" id="next-steps"></a>

To configure the tenant IdP, enable customer IdP support, and set up the token claims, see **Set up Account Based Licensing with identity providers**.

For the customer administrator workflow, see **Customer identity providers in the End User Portal**.

For applications that need to choose the external sign-in method before authentication, see **Authentication Discovery API**.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.nalpeiron.com/zentitle2-docs/ui-administration/configuration/account-based-licensing-identity-based-licensing.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.