caption: Configure allowed local authentication factors
desc: |-
  Setting the policy controls which local authentication factors can be used for both login and reauthentication on <ph name="PRODUCT_OS_NAME">$2<ex>Google ChromeOS</ex></ph>.

        To allow:

        * Every local authentication factor, use ["ALL"] (includes factors added in the future).

        * Only PIN, use ["PIN"].

        * Only Local Passwords, use ["LOCAL_PASSWORD"].

        If the policy is unset or set to an empty list, no local auth factors are available for managed users.
example_value:
- PIN
features:
  dynamic_refresh: true
  per_profile: false
items:
- caption: All
  name: ALL
  value: ALL
- caption: PIN
  name: PIN
  value: PIN
- caption: Local Password
  name: LOCAL_PASSWORD
  value: LOCAL_PASSWORD
owners:
- fahadmansoor@google.com
- ghostbusters@google.com
- cros-lurs@google.com
# LINT.IfChange(LocalAuthFactorsPolicySchema)
schema:
  items:
    enum:
    - ALL
    - PIN
    - LOCAL_PASSWORD
    type: string
  type: array
# LINT.ThenChange(//chromeos/ash/components/osauth/public/auth_policy_utils.cc:LocalAuthFactorsPolicyMap)
default_for_enterprise_users: []
supported_on:
- chrome_os:150-

tags: []
type: string-enum-list
