# Domain Authentication Behavior

The default installation of LSA contains entries in a properties file for administrators and authenticated users. The properties file contains two access groups for LSA.

- full_access_groups – Administrators and non-administrators
- readonly_access_groups – Authenticated users

LSA supports multiple comma (,) separated group names for both administrators and authenticated users. Users that are part of both groups are assigned administrative access to LSA. Server administrators can edit entries or add multiple groups to the individual entries.

Users who are part of the full_access_group will have full access to LSA even if they are not an administrator. If the administrator group value is removed from the full_access_group, an error message will display Invalid Credentials, and you will not be able to access LSA.

Users who are part of the readonly_access_group will be given read-only access by default. If the authenticated users group value is removed from the readonly_access_group, an error message will display Invalid Credentials, and you will not be able to access LSA even in read-only mode.

LSA will prompt users to provide the domain name, user name, and password of the server they are trying to access. Once the credentials are verified, users will given access based on their assigned access level.

- Adding Translated Names in Windows
- Adding Translated Names in Linux
- Using LDAP Authentication

Parent topic: Performing Initial Configuration