Pluggable sign-in mechanisms — the Security extension family that adds new ways to authenticate beyond the built-in user/password form, each declaring its own configuration schema.
A login extension is an installable package that adds an alternative way to enter Kwirth. The built-in user/password login is always available for the bootstrap admin account; on top of it you can install login methods that change how people sign in.
Each login extension ships a config schema, so Kwirth renders its settings form automatically — no bespoke UI per method. Login extensions sit alongside Identity providers: an IdP delegates authentication to an external SSO provider, while a login extension is the sign-in mechanism itself.
Login extensions are managed like any other family — install from the catalog, from a URL, or by uploading a .tgz; configure from the schema-driven form; enable to make them appear on the sign-in screen. Installed methods and their config live in the platform state.
A login extension only proves who the person is. What they can see and do is decided entirely by their scopes and resources (RBAC) — see Security. Even an anonymous login is safe when scoped tightly: the method changes the door, not the permissions behind it.