The Security section allows you to control access to your portal and monitor all users activity. It includes four subsections: Portal Access, Access Rights, Login History and Audit Trail.
Controlling portal access
The Portal Access subsection of the Security settings allows you to provide users with secure and convenient ways to access the portal.
Password strength settings
This section allows you to determine password complexity (the effectiveness of a password in resisting guessing and brute-force attacks). To do that,
This section allows you to enable two-step verification that ensures more secure portal access. A user can access the portal data after entering his/her regular email and password or signing in via a social account and typing in a six-digit verification code received via SMS. The SMS messages are sent to the user primary mobile phone which is specified at the first portal login via the two-factor authentication and later can be changed on the user profile page. A verification code can be resent by clicking the Send code again button, but no more often than 5 times per 5 minutes. The sent code is valid for 10 minutes.
To enable this feature,
- make sure that one of the SMS providers is connected in the Integration section,
- check the Enable radiobutton under the Two-factor authentication section and click the Save button at the bottom of the section to make the parameters you set take effect.
SMS messages can be sent if you have a positive balance only. You can always check your current balance in your SMS provider account. Do not forget to replenish your balance in good time.
To learn more on how to use the two-factor authentication on your portal you can read the following article.
Trusted mail domain settings
This section allows you to specify the mail servers used for user self-registeration in your portal. By default, this option is disabled. To enable it,
- check the Custom domains radiobutton,
- enter the trusted mail server in the field which appears below,
- check the Add users as guests box if you wish the added users to get the view-only permissions,
- click the Save button at the bottom of the section to make the parameters you set take effect.
To add more mail servers, use the Add trusted domain link. To delete a server added by mistake, click the corresponding icon to the right of the field.
After that any user who has an account at a specified mail server will be able to register him(her)self clicking the Click here to join link on the Sign In page and entering the email address. An invitation email with a link to the portal will be sent at the specified email address. To sign in the user will need to follow the link provided in the email, enter a password and confirm it.
To disable this option again just check the Disabled radiobutton.
IP security settings
This section allows you to prevent unwanted visitors from accessing your portal by allowing access to the portal from trusted networks only. If a user attempts to log in to your portal from any IP address except those you specify, this login attempt will be blocked. To restrict access to your portal based on the IP addresses,
- check the Enable radio button;
- click the Add allowed IP address link;
- in the entry field that appears, specify a single IP address in the IPv4 format (#.#.#.#, where # is a numeric value from 0 to 255) or set an IP addresses range by entering the starting and ending IP addresses of the range in the #.#.#.#-#.#.#.# format;
You can find the information on your portal visitors IP addresses in the Login History subsection of the Security settings by clicking the Download and open report button.
- in the same way, add as many trusted IP addresses as you need;
- click the Save button at the bottom of the section.
If necessary, you can delete the added IP addresses by clicking the corresponding icon to the right of the IP address. To disable this option again just check the Disable radio button and click the Save button.
Administrator message settings
This section allows you to display the contact form on the Sign In page so that people could send the message to the portal administrator in case they have troubles accessing the portal.
To enable it, just check the corresponding radiobutton and click the Save button at the bottom of the section to make the parameters you set take effect.
This section allows you to set time (in minutes) before the portal users will need to enter the portal credentials again in order to access the portal.
To set session lifetime, check the Enable radiobutton, enter the necessary time value measured in minutes in the Lifetime field that appears and click the Save button at the bottom of the section to make the parameters you set take effect. After save all the users will be logged out from portal.