---
title: "Local user database"
slug: "local-user-database-v6-5"
description: "Learn how to manage local user accounts in Appgate SDP, including the Builtin Administrator, password policies, and secure access controls."
updated: 2025-10-31T18:24:09Z
published: 2025-10-31T18:24:09Z
canonical: "support.appgate.com/local-user-database-v6-5"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.appgate.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Local user database

This section explains how local user accounts are managed in Appgate SDP.

"Local users" are user identities that have been added to the local (Controller) system database. The "Builtin Administrator" Local User account is pre-configured in the Local Database to enable full system administration and cannot be deleted.

Local users can be added to the Local Database to provide accounts for other administrators or for temporary users not listed in an external Identity Provider.

The local user database is not intended as an IdP for large user groups in a production environment. An external IdP must be configured for this purpose.

*Use the* [*Identity Providers*](/v1/docs/built-in-idp-settings) *UI to configure Local*

## System administrator account

The "Builtin Administrator" system administrator account is pre-configured in your Appgate SDP system. Note that the Builtin Administrator account should not be changed or deleted.

To provision access for other administrators, refer to [Getting Started >System Administration](/v1/docs/admin-user-access).

## Managing accounts and passwords

To create local user accounts, edit account details, or change the user's password for an existing local user account:

- Use [Local Users](/v1/docs/configure-local-users).
- Use **+ Add New** or select the name of the user to open the editing window.

## Password Policy

The local user database has:

- A minimum password strength setting. The default setting is five characters.
- A built-in, configurable lockout policy. The default setting will lock out the user for one minute after five consecutive failed attempts within one minute.

This can be configured in [Identity Providers > Local](/v1/docs/built-in-idp-settings).

## Client authentication

**Client sign-in**. When Local has been selected on the Client sign-in screen, the username and password must be entered and the user can select the *Keep me signed in* option. This will remember the credentials and use them to auto start the client and automatically sign the user in next time. The Controller will map attributes based on the username entered to populate user Claims and issue Claims and Entitlement tokens.

**Claims Token renewal**. When the user's Claims token expires, the Client uses the cached username/password credentials (if available) to handle token renewal automatically. Normally this is transparent to the user. When the user credentials no longer match, the user will be prompted to re-authenticate to renew the token.

**Password user interaction**. If a password user interaction is triggered, the Client will ask the user to type in a password. This might be from the IdP used for signing in or it could be a different IdP.

## Administrator authentication

This method can also be used to authenticate an administrator signing in to the admin UI and for REST API calls.

Appgate SDP (Software Defined Perimeter) is a security solution that provides secure access to resources based on user identity and context, leveraging a zero trust security model.

The Controller is the central management appliance in the Appgate ZTNA system, responsible for user authentication, policy distribution, and overall system administration.

A Policy is a set of rules that govern access control and permissions for users and devices within the Appgate ZTNA system. Policies determine what resources users can access based on their entitlements.

Key-value pairs related to the identity and content of the user or device and are specific to each session.

A defined access right or permission granted to users or devices, allowing them to access specific resources or functionalities within the Appgate ZTNA system.

A digital key used to authenticate and authorize users or devices, enabling secure access to resources.