Security Settings
The Security Settings page allows you to fine-tune the password requirements and cap session times for Portal users.
Session Time
Max Idle Session Time - Set an idle time limit to automatically sign out any inactive user
Max Session Time - Set a session end time so that an active user will be prompted to sign in again
Password Settings
Password Expiration - For how many days should passwords remain valid?
Password Expiration Reminders - How many days before the password expires should a user be prompted to change the password?
Reusing Previous Passwords - How many of the user's previous passwords should be prohibited from being reused?
Regular Expression Validation - Use a regular expression instead of a simple password policy?
Minimum Password Length - The minimum length of the password
Uppercase required - Does the password need to contain at least one uppercase letter?
Lowercase required - Does the password need to contain at least one lowercase letter?
Numeral required - Does the password need to contain at least one digital letter?
Special character required - Does the password need to contain at least one special letter?
Multi-Factor Authentication
When multi-factor authentication is enabled, a one time passcode is required for all users to securely complete the login process. When a user signs in, an authentication code is automatically sent to their email address. A new screen will appear in the Portal prompting the user to enter the code that has been sent to them. The passcode screen is time sensitive and will time out after 5 minutes. If the time expires, the user is redirected back to the sign-in page to try again.
Account Lockout
This section allows you to lock out a specific username if there are repeated consecutive attempts to log into their account with incorrect details. This security feature prevents brute force attacks on any Portal user accounts. Enabling this function will prevent any further login attempts once all login attempts are exhausted.
Lockout after a set number of failed attempts - Enable or disable the lockout feature here
Number of Failed Login Attempts Before Account Lockout - Set the number of attempts allowed before an account is locked
Account Lockout Duration - Set how many minutes a user account will remain locked out
How it Works
Once a user has exhausted the number of login attempts available, a notification will appear on screen advising them that their account has been locked. A legitimate user can bypass the lockout duration period by clicking on the Send Unlock Email button or if they have forgotten their password they can click on Forgot Password to reset their details and unlock their account.
An email will be sent to the username’s registered email address with an Unlock Account button contained within the body of the email. Once the user clicks that button, they will be brought back to the Portal UI and informed that their account has been unlocked and they can try to Sign In again.
