Configuring and managing user authentication (SETTINGS > Security Policies - User Auth).

Lockouts

A username lockout policy specifies the number of incorrect password a user can enter within a specified time period, after which the user account is locked. Lockouts can be set to expire after a configurable amount of time has elapsed.

Make your selections and click Change Lockout Policy

Options:

  • Enable Username Lockouts.
  • Lock Out Users After. Number of tries within number of minutes, after which the account is locked.
  • Expire Lockout after. Number of minutes that must pass after the lockout takes effect before the user can attempt to sign on again. Value of 0 means the lockout period does not expire, and the Admin must reactivate the user.

Auth Method (Authentication Method)

By changing the authentication method to an external server, you place the responsibility of user security on that server. If your authentication server is compromised, the data contained within MOVEit Transfer might also be compromised. If you switch authentication methods to External Only, users must be configured on the external server in order to be able to sign on to MOVEit Transfer.

Options:

  • MOVEit Transfer. The built-in table of usernames and passwords.

    Note: This is the only mode in which the Change password on next sign-on checks are enforced.

  • EXTERNAL Then MOVEit. Use the configured external authentication sources first. If the user fails to authenticate to these sources, fall back on the built-in table of usernames and passwords.
  • EXTERNAL Only. Use only the configured external authentication sources.

Authentication Sources

When a user signs on to the organization for the first time, each active authentication source is tried, in the order listed. If a user successfully authenticates to a source, that source is recorded in the user's profile, so that the user is authenticated against it at the next sign-on. (See the Authentication Source Affinity section of the User Profile page for more details).

The Add/Edit External Authentication Sources list is available when the Auth Method is set to EXTERNAL, Then MOVEit or EXTERNAL Only.

Use the up and down arrows in the Actions column to change the order in which the authentication sources are queried. For more information, see External Authentication.

Use the up and down arrows in the Actions column to change the order in which the authentication sources are queried.

For more information about adding and configuring external authentication sources, see External Authentication.

Multi Sign-ons (Running Concurrent Sessions Using a Single/Shared User)

This section lets an administrator edit the default Deny Multiple Sign Ons setting for the organization. New users will be created with the default setting, and when changed, an option is provided to set all current users with the new setting value.

  • Allowed: Users will be allowed to sign on to the MOVEit Transfer server multiple times using the same interface (web, FTP, SSH, and so on) from different IP addresses. For example, a user will be allowed to sign on to the web interface from two different machines.
  • Prohibited: Users will not be allowed to sign on to the MOVEit Transfer server multiple times using the same interface (web, FTP, SSH, and so on) from different IP addresses. For example, a user WILL be allowed to sign on to the web interface from one machine, and the FTP interface from another, but will NOT be allowed to sign on to the web interface from two different machines. If there are no existing sessions using the same interface from different IP addresses, the user will be allowed to sign on, and additionally any existing sessions using the same interface from the same IP address will be forcibly terminated.

Expiration

This section is where administrators may list, add, edit, delete, and assign account expiration policies. These policies govern how accounts that are assigned the policy will be considered expired and removed from the system. For more information about creating and assigning expiration policies, see the User Account Expiration topic.

Use this account expiration setting...

if you want to...

Edit Account Expiration Policy

Create, edit, and apply a custom account expiration policy for any specific user class.

Expiration policies can be defined with:

  • Specific designated end date.
  • A designated number of days after creation.
  • Relative date. (Based on: creation date, period of inactivity, or number of sign ons)
  • Expiration warning period.
  • Expiration notification.

Delete Users after Expiration

Remove expired accounts automatically (with an optional grace period).

Allow Users to Reactivate TempUsers after Expiration

Enable MOVEit Transfer to reactivate an expired TempUser account when triggered by one of the following conditions:

  • A new package is sent to the MOVEit Transfer TempUser.
  • A new shared folder invitation is sent to the MOVEit Transfer TempUser.
  • A user with Secure Folder Sharing privileges renews a TempUser's access to a previously-shared folder.
Note: This control does not apply to accounts with expiration policies based on a designated end day (a specific date) or when expiration is designated as n days after account creation.

Single Sign on

The Single Sign on feature allows MOVEit Server to authenticate a user without requiring sign on, provided that user is already signed on to a third-party user directory (such as Microsoft Active Directory) using their network or corporate account. This section is where administrators can set up MOVEit as a service provider and configure one or more identity providers. For information on configuring Single Sign-on, see the User Authentication - Single Sign-on page.

Multi-factor Authentication

See the section titled Multi-Factor Authentication.

Configure reCAPTCHA

In order to generate a pattern that a human can read and a machine cannot predict, you need a private and public key. reCAPTCHA challenge prompts can be enabled from different workflows (guest user sign on and password reset, for example) where you want to add an extra-layer of security to mitigate risk of sensitive operations or workflows being compromised by a web bot or malicious script.

Get your reCaptcha Key Pair for Your Domain from Google

To get the keys, search the web for recaptcha follow the links to sign up and register the reCAPTCHA for your site, as applicable. (The service is part of Google, so you need to create or use an existing Google account.) Log in, enter a domain name and the page will display the Public Key and Private Key. Copy them and paste them into the two fields here.

For more information, you can also visit reCAPTCHA FAQs site.

Do Not Clear the Keys When reCAPTCHA is Enabled

If you clear the key fields prior to turning off reCAPTCHA for your org, users configured to use reCAPTCHA will not be able to sign on until you either turn off reCAPTCHA for your org or re-register the reCAPTCHA site keys.

If reCAPTCHA is enabled at your site, valid reCAPTCHA site keys must be present in order for reCAPTCHA patterns to be generated, for Unregistered Recipients to be able to send packages, and users to begin a reset password workflow.

Warning: If you have reCAPTCHA enabled for Unregistered Senders or password reset, never clear the reCAPTCHA key fields while reCAPTCHA is still enabled for users. Always clear the check box (turn off) the use of reCAPTCHA for reCAPTCHA-enabled workflows before you remove site keys.

Trusted Applications

This feature enables normal users in the current org to maintain active sessions from third-party applications. Maintaining sign-on to MOVEit Transfer helps connectors, APIs, and other partner applications access MOVEit Transfer uninterrupted. For example, helps Ad Hoc Transfer users to leverage a Remember Me option when they sign on to MOVEit Transfer from the Ad Hoc Transfer Add-in for Outlook.

Note: MOVEit Transfer establishes a trusted relationship with an application through a security identity token it receives from the application's identity service provider.

To use this feature in your org, create a configuration entry to federate MOVEit Transfer with a trusted application. MOVEit Transfer trusts this provider to verify the corresponding third-party application that needs access to MOVEit Transfer resources through a MOVEit Transfer user. For detailed information, see the topic titled Manage External Applications.

Note: MOVEit Transfer only federates with Microsoft Outlook identity providers, as of the publish date of this document.

Couple Identity Provider (IdP) Service with MOVEit Transfer to Enable Federation with Third-Party Apps and Frameworks