diff --git a/architecture/authentication.adoc b/architecture/authentication.adoc
index 3f0af93abc4f..14be2a3d27b7 100644
--- a/architecture/authentication.adoc
+++ b/architecture/authentication.adoc
@@ -170,6 +170,8 @@ To configure how usernames and passwords are validated, set the `OPENSHIFT_OAUTH
 *** A 200 status with an "id" key indicates success: `{"id":"userid"}`
 *** A successful response may also include name and/or email: `{"id":"userid", "name": "User Name", "email":"user@example.com"}`
 ** Requires the environment variable `OPENSHIFT_OAUTH_BASIC_AUTH_URL` to be set to the remote URL
+* `deny`
+** Any username and password combination is denied
 
 `OPENSHIFT_OAUTH_PASSWORD_AUTH` defaults to `anypassword`