# Realms
Realms define a Nexus Repository user's authentication source. To manage realms, the user requires the `nx-settings` privilege. Manage realms under the _Settings_, _Security_ view.
**Note**
In Nexus Repository Cloud, Sonatype manages Realms. The Realms configuration is not accessible to Cloud users.
- Nexus Repository requires multiple security realms for identifying users. Do not remove all realms from the _Active_ section as this prevents access to Nexus Repository for all users, including administrators.
- Activate a security realm by adding it to the Active list in the right-hand column.
- Prioritize a realm by moving it higher or lower on the list using the up and down arrows available next to each active realm.
The order in which you have your active realms determines what authentication realm is given priority for granting a user access in the event of a name clash between authentication realms.
- You must select Save to preserve changes.
## Available Realms
The table below provides details about each available security realm in the Nexus Repository.
**Note**
Sonatype pre-configures realms for SaaS deployments. Users need not configure realms in Sonatype Cloud.
| Realms | Details | On-Prem Availability | Cloud Availability |
| --- | --- | --- | --- |
| **Ansible Galaxy Bearer Token Realm**
`AnsibleGalaxyToken` | This realm is required for validating the Ansible collections. See [Ansible documentatation](https://help.sonatype.com/en/ansible-repositories.html "Ansible Repositories"). | | |
| **Conan Bearer Token Realm**
`ConanToken` | This realm is required for uploading to Conan repositories and produces tokens in response to the `conan user` command.
See [Conan's documentation](https://docs.conan.io/en/latest/reference/commands/misc/user.html). | | |
| **Crowd Realm**
`Crowd` | This realm identifies external configuration in an Atlassian Crowd system.
See [Atlassian Crowd Support](https://help.sonatype.com/en/atlassian-crowd-support.html "Atlassian Crowd Support"). | | |
| **Default Role Realm**
`DefaultRole` | This realm appends a specific role to use by default for all users once they are authenticated.
See [Default Role](https://help.sonatype.com/en/default-role.html "Default Role"). | | |
| **Docker Bearer Token Realm**
`DockerToken` | This realm is required to access Docker repositories through a Docker client or other container image manager.
It is also required to allow anonymous pull access to Docker repositories.
See [Docker Authentication](https://help.sonatype.com/en/docker-authentication.html "Docker Authentication") | | |
| **HuggingFace Bearer Token Realm**
`HuggingFaceToken` | Starting with 3.95, Hugging Face bearer token realm can be used for authentication
See [Hugging Face Repositories](urn:resource:component:798517) | | |
| **LDAP Realm**
`LdapRealm` | This realm identifies external storage in an LDAP identity provider.
See [LDAP](https://help.sonatype.com/en/ldap.html "LDAP") | | |
| **Local Authenticating Realm**
`NexusAuthenticatingRealm` | This realm is required to use the built in user management. They allow Nexus Repository to manage authentication without an external identity provider.
Keep the Local Authenticating realm at the top of the active list. In the event of system recovery, restoration is difficult when this realm is lower in order or removed. | | |
| **npm Bearer Token Realm**
`NpmToken` | This realm permits users with previously generated bearer tokens to publish npm packages. It also allows users to establish the authentication to a repository with the `npm adduser` (`npm login` is an equivalent alias) command.
See [npm Security](https://help.sonatype.com/en/npm-security.html "npm Security") | | |
| **NuGet API-Key Realm**
`NuGetApiKey` | This realm is required for deployments to NuGet repositories.
See [NuGet Repositories](https://help.sonatype.com/en/nuget-repositories.html "NuGet Repositories") | | |
| **OAuth2 Realm**
`OAuth2Realm` | Authenticates users via OAuth2 JWT tokens from a configured OpenID Connect provider, syncing group claims as roles.
See [Open ID Connect documentation](https://help.sonatype.com/en/openid-connect.html "OpenID Connect") | | |
| **OCI Bearer Token Realm**
`OciBearerToken` | This realm is necessary for configuring OCI authentication. See [OCI Repositories](https://help.sonatype.com/en/oci-repositories.html "OCI Repositories"). | | |
| **Pub Bearer Token Realm**
`PubTokenRealm` | Validates Dart or Flutter tokens for Pub package operations
See [Pub / Flutter documentation](https://help.sonatype.com/en/pub-repositories.html "Pub or Flutter Repositories") | | |
| **Rut Auth Realm**
`rutauth-realm` | This realm allows the use of any external security system that passes the user details through HTTP headers for requests to Nexus Repository.
See [Authentication via Remote User Token](https://help.sonatype.com/en/authentication-via-remote-user-token.html "Authentication via Remote User Token") | | |
| **SAML Realm**
`SamlRealm` | This realm uses an external Identity Provider (IdP) to handle authentication.
See [SAML](https://help.sonatype.com/en/saml.html "SAML") | | |
| **Terraform Realm**
`TerraformToken` | This realm validates base64-encoded or encrypted tokens embedded in Terraform URLs.
See [Terraform documentation](https://help.sonatype.com/en/terraform-repositories.html "Terraform Repositories") | | |
| #### User Token Realm
`User-Token-Realm` | This realm is to enable user tokens as a method for authentication that would normally require passing your username and password in plain text.
See [Security Setup with User Tokens](https://help.sonatype.com/en/user-tokens.html "User Tokens") | | |