Settings - Security User Auth

Configuring and managing user authentication (SETTINGS > Security Policies - User Auth).

Lockouts

A username lockout policy specifies the number of incorrect password a user can enter within a specified time period, after which the user account is locked. Lockouts can be set to expire after a configurable amount of time has elapsed.

Make your selections and click Change Lockout Policy

Options:

Enable Username Lockouts.
Lock Out Users After. Number of tries within number of minutes, after which the account is locked.
Expire Lockout after. Number of minutes that must pass after the lockout takes effect before the user can attempt to sign on again. Value of 0 means the lockout period does not expire, and the Admin must reactivate the user.

Auth Method (Authentication Method)

By changing the authentication method to an external server, you place the responsibility of user security on that server. If your authentication server is compromised, the data contained within MOVEit Transfer might also be compromised. If you switch authentication methods to External Only, users must be configured on the external server in order to be able to sign on to MOVEit Transfer.

Options:

MOVEit Transfer. The built-in table of usernames and passwords.
Note: This is the only mode in which the Change password on next signon checks are enforced.
EXTERNAL Then MOVEit. Use the configured external authentication sources first. If the user fails to authenticate to these sources, fall back on the built-in table of usernames and passwords.
EXTERNAL Only. Use only the configured external authentication sources.

Authentication Sources

When a user signs on to the organization for the first time, each active authentication source is tried, in the order listed. If a user successfully authenticates to a source, that source is recorded in the user's profile, so that the user is authenticated against it at the next sign-on. (See the Authentication Source Affinity section of the User Profile page for more details).

The Add/Edit External Authentication Sources list is available when the Auth Method is set to EXTERNAL, Then MOVEit or EXTERNAL Only.

Use the up and down arrows in the Actions column to change the order in which the authentication sources are queried. For more information, see External Authentication.

Use the up and down arrows in the Actions column to change the order in which the authentication sources are queried.

For more information about adding and configuring external authentication sources, see External Authentication.

Multi Sign-ons (Running Concurrent Sessions Using a Single/Shared User)

This section lets an administrator edit the default Deny Multiple Sign Ons setting for the organization. New users will be created with the default setting, and when changed, an option is provided to set all current users with the new setting value.

Allowed: Users will be allowed to sign on to the MOVEit Transfer server multiple times using the same interface (web, FTP, SSH, etc.) from different IP addresses. For example, a user will be allowed to sign on to the web interface from two different machines.
Prohibited: Users will not be allowed to sign on to the MOVEit Transfer server multiple times using the same interface (web, FTP, SSH, etc.) from different IP addresses. For example, a user WILL be allowed to sign on to the web interface from one machine, and the FTP interface from another, but will NOT be allowed to sign on to the web interface from two different machines. If there are no existing sessions using the same interface from different IP addresses, the user will be allowed to sign on, and additionally any existing sessions using the same interface from the same IP address will be forcibly terminated.

Expiration

This section is where administrators may list, add, edit, delete, and assign account expiration policies. These policies govern how accounts that are assigned the policy will be considered expired and removed from the system. For more information about creating and assigning expiration policies, see the Expiration Policies Feature Focus page.

Use this account expiration setting...	if you want to...
Edit Account Expiration Policy	Create, edit, and apply a custom account expiration policy for any specific user class. Expiration policies can be defined with: Specific designated end date. A designated number of days after creation. Relative date. (Based on: creation date, period of inactivity, or number of sign ons) Expiration warning period. Expiration notification.
Delete Users after Expiration	Remove expired accounts automatically (with an optional grace period).
Allow Users to Reactivate TempUsers after Expiration	Enable MOVEit Transfer to reactivate an expired TempUser account when triggered by one of the following conditions: A new package is sent to the MOVEit Transfer TempUser. A new shared folder invitation is sent to the MOVEit Transfer TempUser. A user with Secure Folder Sharing privileges renews a TempUser's access to a previously-shared folder. Important: This control does not apply to accounts with expiration policies based on a designated end day (a specific date) or when expiration is designated as n days after account creation.

Single Sign on

The Single Sign on feature allows MOVEit Server to authenticate a user without requiring sign on, provided that user is already signed on to a third-party user directory (such as Microsoft Active Directory) using their network or corporate account. This section is where administrators can set up MOVEit as a service provider and configure one or more identity providers. For information on configuring Single Sign-on, see the User Authentication - Single Sign-on page. For information on general requirements, supported functionality, and how to deploy single sign on to users, see the Single Sign-on Feature Focus page.

Multi-factor Authentication

See the section titled Multi-Factor Authentication.

Configure reCAPTCHA

In order to generate a pattern that a human can read and a machine cannot predict, you need a private and public key. reCAPTCHA challenge prompts can be enabled from different workflows (guest user sign on and password reset, for example) where you want to add an extra-layer of security to mitigate risk of sensitive operations or workflows being compromised by a web bot or malicious script.

To get the keys, search the web for recaptcha follow the links to use the reCAPTCHA service on your site and to sign up, as applicable. The service is part of Google, so you need to create or use an existing Google account. Log in, enter a domain name and the page will display the Public Key and Private Key. Copy them and paste them into the two fields here.

For more information, you can also visit the reCAPTCHA FAQs site.

If you have reCAPTCHA enabled for Unregistered Senders or password reset, never clear the reCAPTCHA key fields. Always clear (disable) the use of reCAPTCHA for reCAPTCHA-enabled workflows prior to removing these keys. If either of these user scenarios are enabled, valid keys must be present in order for reCAPTCHA patterns to be generated and for your Unregistered Recipients to be able to send packages and/or users to begin a reset password workflow.