Skip to main content

Manage authentication

Features

• Configure the password policy

• Manage access policies

• Configure 2FA Authentication

• Configure authentication parameters

Configure the password policy​

Perform this task to configure the password complexity and password validity period. When you add

an operator to the system, select the appropriate password policy for the operator. The password policy defines the minimum length, complexity requirement, and validity period of the passwords.

Restrictions and guidelines

• In RBAC mode, only a security administrator can configure the password policy.

• Modifications to the password policy immediately take effect and take effect on registered operators after their passwords expire.

• The settings for parameters such as minimum password length and complexity requirement in the password policy do not take effect on the passwords of hosts (including both service hosts and management hosts).

Add a password policy

  1. On the top navigation bar, click System.

  2. From the left navigation pane, select AuthN Management > Password Policy.

  3. Click the Add button to create a new password policy. For an existing password policy, click the Edit button to make changes. Password policy parameters:

    ○ Min Length: Set the minimum length for an operator password. In insecure mode, the value range is 1 to 14. In secure mode, the value range is 8 to 14.

    ○ Complexity: Set the operator password complexity. Options include: No limit, Contains letters and digits, Contains letters, digits, and special chars, and Contains uppercase and lowercase letters, digits, and special chars. The default is Contains letters, digits, and special chars. For special characters, see the special characters table.

    ○ Validity Period: Enter the validity period of the password. In insecure mode, the default is 0, meaning no restrictions. In secure mode, the default value is 1.

    ○ Most Recent Passwords to Check: Specify the number of previous passwords (including the current one) from which the new password must be different. For example, when you set this option to 1, the new password cannot match the current password. When you set this option to 2, the new password cannot match the current or previous password. Special characters table (all characters are half-width): Character Name Character Name ~ Tilde ` Apostrophe ! Exclamation mark @ At sign

    Pond sign $ Dollar sign

    % Percent sign ^ Caret & And sign * Asterisk () Parentheses = Equal sign

    • Plus sign | Vertical line
    • Minus sign N/A Underscore

    [] Square brackets {} Curly brackets : Colon ; Semicolon

    Double quotation \ Backslash “ marks

    , Comma / Slash . Dot <> Angle brackets ? Question mark Space

  4. After you set the parameters, click OK to complete the operation.

Delete a password policy

  1. On the top navigation bar, click System.

Manage access policies​

An access policy defines access control settings for operators. An administrator can reference an

access policy to allow or deny the management platform login of operators. An access policy takes effect only when it is referenced. Access policies include the following types:

• IP control policy—Limits the IP addresses that operators use to access the system.

• Access time and IP control policy—Limits both the access time and IP addresses of operators.

If both the access time and IP addresses of operators are limited, the following rules apply:

• For an operator who uses an IP address specified in a rule of the effective access policy:

○ If the rule permits the IP address, the operator can access the system within the allowed time periods.

○ If the rule denies the IP address, the operator cannot access the system.

• For an operator who uses an IP address not specified in any rules of the effective access policy:

○ If the default action is allow, the operator can access the system within the allowed time periods.

○ If the default action is reject, the operator cannot access the system.

Restrictions and guidelines

• In RBAC mode, only a security administrator can configure access policies.

• Actions in the rules of an access policy cannot be the same as the default action of the access policy.

• Access policies being used by operators cannot be deleted.

• An access policy can contain multiple rules.

Add an access policy

  1. On the top navigation bar, click System.

  2. From the left navigation pane, select AuthN Management > Access Policies.

  3. Click Add.

  4. Configure the parameters as described in "Parameters."

  5. Click Add Rule.

  6. Configure the parameters, and then click OK. To edit or delete a rule, click Edit or Delete in the Actions column for that rule, respectively.

  7. Click OK.

Edit an access policy

  1. On the top navigation bar, click System.

  2. From the left navigation pane, select AuthN Management > Access Policies.

  3. Select the target access policy and click Edit.

  4. Configure the parameters as described in "Parameters."

  5. Click Add Rule.

  6. Configure the parameters, and then click OK. To edit or delete a rule, click Edit or Delete in the Actions column for that rule, respectively.

  7. Click OK.

Delete access policies

  1. On the top navigation bar, click System.

  2. From the left navigation pane, select AuthN Management > Access Policies.

  3. To delete a single access policy, click Delete in the Actions column for that access policy. To bulk delete access policies, select the target access policies and click Delete.

  4. In the dialog box that opens, click OK.

Display detailed information about an access policy

  1. On the top navigation bar, click System.

  2. From the left navigation pane, select AuthN Management > Access Policies.

  3. Select the target access policy, and then and click View.

Parameters

• Name: Name of the access policy.

• Description: Description for the access policy.

• Default Action: Select the action to take on operators that do no match any access policy rules. Options include Allow and Reject.

• Access Time: Configure the time when operators matching the access policy can access the system. Options include Off, Weekly, and Daily.

○ Off: The time when the operators can access the system is not limited.

○ Weekly: Set the days for allowing/denying access each week (for example, Monday to Friday), and set the effective time period for allowing/denying access on the days (configured on an hourly basis, from 0 o'clock to 23 o'clock).

○ Daily: Set the effective time period for allowing/denying access each day (configured on an hourly basis, from 0 o'clock to 23 o'clock).

• Start IP: Enter the start IP of the IP address range. If the IP address of an operator is within the IP address range, the operator matches the rule.

• End IP: Enter the end IP of the IP address range.

• Action: Select the action to take on operators that match the rule. Options include Allow and Reject.

Configure 2FA Authentication​

Perform this task to enable operators to log in to the system through certificate authentication,

one-time passwords (OTPs), or verification codes. After you enable 2FA, operators log in to the system with usernames, passwords, and PIN numbers, OTPs, or verification codes.

Restrictions and guidelines

In RBAC mode, only a security administrator can configure 2FA. To enable certificate authentication, make sure the uploaded root certificate is correct and the USB key can be used to log in to the system correctly. To enable OTP authentication, make sure the uploaded agent configuration file is correct.

Procedure

  1. On the top navigation bar, click System.

  2. From the left navigation pane, select AuthN Management > 2FA Authentication. The current 2FA authentication settings are displayed.

  3. Click Edit.

  4. To enable 2FA, select Yes, and then select the authentication mode and configure the related parameters, and then click OK.

  5. If you select SMS CAPTCHA, click SMS CAPCHA Settings, and then select Enable Verification Code. For more information, see "Configure SMS parameters"

  6. To clear the 2FA authentication settings and restore the disabling state, click Reset.

Parameters

• Enable 2FA: Enable 2FA to configure the operators to log in to the system with usernames, passwords, and PIN numbers, OTPs, or verification codes.

• Authentication: Select the authentication mode. Options include Certificate Authentication, OTP, and Verification Code, and SMS CAPTCHA.

○ If you enable certificate authentication, you must also configure the following parameters:

▪ Manufacturer Type: Select a manufacturer type. Options are InfoSec and Jumborca Fisec.

▪ Root Certificate: Select the root certificate used to verify the USB keys. The selected root certificate is automatically uploaded to the system. The root certificate file cannot exceed 5 MB.

▪ Scheduled CRL Update: Enable the system to update the CRL regularly. If you enable this feature, you must also configure the following parameters:

▪ URL: Enter the website address for filtering the CRL.

▪ Frequency: Select the CRL update frequency. Options include Monthly, Weekly, and Daily.

▪ Date: Specify the date when the CRL will be updated. Configure this parameter if you select the Monthly frequency.

▪ Days: Specify the day when the CRL will be updated. Configure this parameter if you select the Weekly frequency.

▪ Time: Specify the time when the CRL will be updated.

○ If you enable OTP authentication, you must also configure the following parameters:

▪ OTP Vendor: Specify the OTP vendor. Options include FEITIAN and AISEC.

Configure authentication parameters​

Restrictions and guidelines

• With RBAC enabled, only system administrators and security administrators can configure authentication server settings.

• As a best practice, do not enable both SSO authentication and 2FA.

• Login failures might occur because of incorrect OSS authentication settings, connection failures between the system and the OSS server, or server failures. In this case, you can access http://{ip}?forceSkipSSO=1 or https://{ip}?forceSkipSSO=1 to log in to the system without SSO authentication, and then change the SSO authentication settings or disable it. If you still cannot log in to the system through http://{ip}?forceSkipSSO=1 or https://{ip}?forceSkipSSO=1, clear the cache in your Web browser and log in again.

Configure authentication settings

An enterprise network typically contains office automation, financial information filter, email, and network device and server management applications. All these applications require identity authentication, and different applications require different authorities. The management platform provides support for LDAP authentication to perform centralized management on the identity authentication information. Perform this task to configure the LDAP authentication server. When an operator logs in to the management platform through the LDAP authentication mode, the operator must pass the identity authentication on the server.

  1. On the top navigation bar, click System.

  2. From the left navigation pane, select AuthN Management > Authentication Parameter Settings.

  3. Click Edit in the Authentication Server area.

  4. Configure the parameters as described in "Parameters."

  5. To check the settings, click Connectivity Test.

  6. Click Save.

Configure SSO authentication

SSO authentication configuration is not supported in RBAC mode.

This function is a collaboration of the management platform and Central Authentication Service (CAS) to implement Single Sign-On (SSO) authentication. This authentication method is an open-source solution that provides user authentication and authorization services, allowing users to access multiple applications without re-entering their credentials after logging in the system once.

  1. On the top navigation bar, click System.

  2. From the left navigation pane, select AuthN Management > Authentication Parameter Settings.

  3. Click Edit in the SSO Configuration area.

  4. Configure the parameters as described in "Parameters."

  5. Click Save.

  6. In the dialog box that opens, click OK.

Parameters

Authentication server:

• Server Address: Enter the IP address or domain name of the LDAP server.

• Port Number: Enter the TCP port number of the LDAP server.

• Version: Select an LDAP version. Options include 2 and 3.

• Type: Select an LDAP server type. Options include Generic LDAP Server and Microsoft Active Directory.

• User Naming Attribute: Enter the user naming attribute. If you select Generic LDAP Server for the Type parameter, the default user naming attribute is cn. If you select Microsoft Active Directory for the Type parameter, the default user naming attribute is sAMAccountName.

• Admin Password: Enter the password used to access the LDAP server.

• Admin DN: Enter the administrator DN used to access the LDAP server, cn=Administrator,cn=users,dc=abc,dc=com for example. The first cn represents the username of the LDAP server administrator, the value of the second cn is fixed at users, the first dc and second dc represents the first and any part of distinguished server name, respectively.