Security settings

Set how users access your account: single sign-on (SSO), two-factor authentication (2FA), user account security, and passwords.

To open the Security page:

1. Select the Account settings icon (gear) in the web interface header.
2. Go to Security.
3. On a parent account with sub-accounts, each sub-account has its own security settings.

Configure single sign-on (SSO)

With single sign-on (SSO), users access several applications with one set of credentials. You can use SSO with any identity provider (IdP) that uses the SAML 2.0 protocol. The platform supports two SAML flows. In the SP-initiated flow, users start the login from the platform. In the IdP-initiated flow, users start from your identity provider. The login steps use the SP-initiated flow, which is the main flow.

For an example with a specific identity provider, see Set up SSO integration with Okta. The same setup applies to other SAML 2.0 providers.

Before you start

Your IT team configures SSO in your identity provider. In the web interface, only users with the Account admin role can set it up. After you set up SSO, the Account admin chooses how users log in: with SSO only, or with SSO or their regular credentials.

Enable SSO

You can set up SSO yourself. The platform, as the service provider (SP), does not need any other information from you.

1. Open the SSO settings. On the Security page, in the Single Sign-On (SSO) section, select Configure.
2. Enter the identity provider details:
   • SP Entity ID: The unique identifier of the platform as your service provider. It establishes a trusted connection with your identity provider.
   • IdP Signature Certificate: Paste the certificate from your identity provider. It validates SSO requests and responses.
   • IdP Login URL: The URL the platform sends users to, so they can authenticate with your identity provider.
   • IdP Logout URL: The URL the platform sends users to after they log out.
3. Set the SP Initiation URL. Enter your custom domain to complete the URL. The URL starts with the login domain of your account, for example https://portal.infobip.com/login/saml/. Users start the SSO login from this URL, so share it with all users in your account.
4. Add the ACS URL to your identity provider. The platform generates the SP Assertion Consumer Service (ACS) URL automatically. It appears when you set the SP Initiation URL. Your identity provider sends SAML assertions to it.
5. Choose the optional settings, and then select Save.

Optional settings:

• Auto-create users: Creates a user automatically after a successful login through your identity provider, if no user with a matching email address exists. The platform creates the user from the SAML response. With this option, you do not need to create users in advance. If this option is off, create all users in advance, with email addresses that exactly match the NameID. Otherwise, their login fails.
• Auto-create groups: Syncs user groups and memberships from your identity provider on each login. This option needs additional configuration in your identity provider.

To use one configuration for several sub-accounts, contact your account manager. For the login steps, see Log in with single sign-on (SSO).

Identity provider requirements

Configure the Name Identifier (NameID) attribute in your identity provider.

The supported NameID options are:

• Email
• UPN (User Principal Name)

The value must be in email address format. By default, the email address of the user is the same as the NameID. To use a different email address, include this claim in the SAML response: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress

Extend the SAML response

To set the first and last name of users automatically with Auto-create users, and to sync groups, add these claims to the SAML response:

• First name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
• Last name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
• Group membership: http://schemas.xmlsoap.org/claims/Group

For group synchronization, the group membership values must use SamAccountName or Name as the identity. Groups are mapped by group name, not by other identifiers such as SID.

When Auto-create groups is on:

• You do not need to create groups in advance. They are created automatically.
• On each login, the group attribute is sent with the SAML data and mapped to custom roles.
• If a group from your identity provider does not exist as a custom role, the platform creates a custom role with the same name.
• Group creation, mapping, and memberships are automatic. You still manage the permissions of each custom role in the web interface.

You can use custom roles that you create yourself and custom roles created through SSO group sync at the same time. For roles created through SSO group sync, you cannot change the user memberships.

Two-factor authentication

2FA works in two ways:

• On new devices: Users complete a 2FA check each time they log in from a new device. The platform stores up to five authorized devices for each user. This check is always on, and you cannot turn it off.
• On every login: Users complete a 2FA check on every login, not only on new devices. This option is available only on some accounts. If it is enabled for your account, a user with the Account admin role can turn it on. It then applies to every user in the account. To ask for the option, contact your account manager or Support.

For the login steps, see Complete two-factor authentication in Account access.

User account security

Set these rules for all users in your account:

• Maximum user inactivity: The number of days a user can be inactive before their user is disabled automatically. The range is 15 to 365 days.
• Maximum login attempts: The number of failed logins in a row before a user is disabled automatically. The recommended value is five attempts.
• Password validity: The number of days before a password expires. The recommended value is 90 days. If you leave this field empty, passwords do not expire.

Password rules

Password strength is set to very strong by default. Passwords must:

• Contain at least one lowercase letter
• Contain at least one uppercase letter
• Contain at least one number
• Contain at least one symbol
• Contain 10 to 50 characters
• Not contain the same character three or more times in a row, such as aaa
• Use only A to Z, a to z, 0 to 9, and symbols

For passwords and API keys:

• Use a different password for each user.
• Use passwords that are unique to this account.
• Change passwords at least every three months.
• Keep passwords and API keys private, including from Support and your account manager. If a password or API key was shared, reset the password or rotate the key.

To secure API keys in your integration, see Security best practices. To share secrets safely, transfer files securely, or request permission for security testing, see Security procedures.