Select the box if the authentication should be done by a third party provider.

The fields on the External Authentication panel become editable.

Select the box to manage passwords externally (password will not be stored within the system). If selected, the information available in the user’s Profile Settings is restricted to e-mail information, language, date and decimal format settings.

Select the box to specify the external authenticator configuration. The following fields become enabled:

• Auth Module: class name of an authentication module

• Identity Store: class name of an identity store

• Webservice Auth Module: class name of a webserivce authentication module

• Webservice Identity Store: class name of a webservice identity store

For related information see Authentication in [SM IS].

If you use external authentication such as LDAP or RADIUS, further setup of these services is required outside of the AdminClient. For details see the authentication system manual [SM Authentication].

Select the source “Cookie” or “Header”.

This field is enabled if Single Sign-On is selected.

Specify the external User credentials.

This field is enabled if Single Sign-On is selected.

Optionally enter the redirect URL.

This field is enabled if Single Sign-On is selected.

There is always one default policy. If further policies have been set up, select an entry to switch to another policy.

Define a new policy or delete the selected one. See sections To add a password policy and To delete a password policy for details.

Enter a regular expression (see chapter Support of regular expressions) to be used as password check for the current policy. If a regular expression is defined, all other policy settings for the password check are ignored and disabled.

Specify a minimum and maximum length of the password. Maximum Length = “0” means unlimited.

This value indicates the number of passwords that were last used for at least 60 days which are forbidden. A value of 0 deactivates this check.

Select one of the supported languages. The terms from this language dictionary will be forbidden inside passwords.

Specify the time interval in days which determines the password expiry. The user must provide a new password in the login procedure, if the old password has expired.

Enter values for the minimum numbers of the corresponding types of characters.

The default is “0” for upper case and “1” for the other categories.

Enter the number of login failures (with a wrong password) after which a login delay becomes effective. When a delay is effective and a user tries to log in, an error message "Login Delayed" will be displayed.

By default (with value 0) the delay mechanism is not active at all.

The delay becomes ineffective again, when the time interval specified by “Clearance Time” has passed (see further below).

Enter the delay time in seconds, which becomes effective depending on the parameter “Effective After Number of Unsuccessful Trials”.

If the delay mechanism is active, and a login failed for the first time, the user needs to wait 10 seconds (by default) until a login is possible again.

If the option “Increase Delay Dynamically” is activated, which is true by default (see further below), the actual delay time is the value defined here multiplied by the number of unsuccessful trials.

Enter the time interval calculated from the last unsuccessful trial after which the delay becomes ineffective again. A value of “0” means that no delay is ever effective because the delay becomes ineffective immediately.

Assuming that a delay has become effective and the user waits for more than 60 seconds (in case of the default value) before trying to log in again, no delay is effective anymore.

In the server-side configuration, the parameter “loginDelay.attemptTimeout” represents the same option as “Clearance Time” in the AdminClient.

Select the box to increase the time of delay after each unsuccessful attempt.

If this option is activated, the actual delay time is the value defined by option “Delay Time” multiplied by the number of unsuccessful trials. In the default case this means: after the first login failure the delay is 10 seconds, after the second failure the delay is 20 seconds and so on.

Maximum amount of seconds for which a login will be delayed when using the dynamic delay increase option.

The default value is “-1”, which means that no upper limit is set.

Enter the number of unsuccessful login attempts after which the user account is locked. If set to 0 (disabled), the user account will not be locked after repeated failed logins.

Select this option to enable the security question reset mechanism. If a security question has been specified, an e-mail can be sent with a link that directs the user to the security question dialog to reset the password.

Select this option to reset the forgotten password using the confirmation of the used e-mail address without answering the security question.

Select this option to enable the security question reset mechanism with the confirmation of the used e-mail address. If a security question has been specified, user has to answer the security question and specify the e-mail address.

Select the box to automatically disable a user account when it is not used for a certain amount of days and enter a number of days in the field After Inactivity (in Days).

Define a list of usernames that will be excluded from the Automatic User Account Expiration settings. You can add or remove users to / from the list of available users using Add / Delete .

Select the box to automatically delete a user account when it is not used for a certain amount of days and enter a number of days in the field After Inactivity (in Days).