Security

User Lockout

User lockout settings establish the criteria for when and for how long a user is temporarily locked out from a known Digital Identity Management User profile (User entity). These settings apply to all Digital Identity Management processes where a user is prompted to provide their password. Configure user lockout from Admin console > Security > User Lockout. For more details, see user lockout in the Process Catalog. User Lockout Settings

App Setting	Description	Default
Maximum failed sign-in attempts	Defines the maximum number of times a user fails to enter the correct password within a specific time frame (defined by the Failed attempts time window setting) before user lockout occurs.	10
Failed attempts time window	The length of time (seconds) where a user’s total failed sign-in attempts are counted towards a temporary lockout. After this time expires, the failed input counter resets to zero.	3600
User lockout duration****	The length of time (seconds) that a user lockout lasts. The end user is unable to sign-in for this duration once the number of failed sign-in attempts is reached.	3600

Multi-Factor Authentication (MFA)

Multi-Factor authentication (MFA) is a security measure that allows a user to register additional methods (or factors) to protect their identity, like a backup mobile number or a third-party authenticator app. Configure MFA from Admin console > Security > MFA. Some examples of registering a second factors for MFA are:

A user registers one of their verified Digital Identity Management authN ID (i.e., email) as a second MFA factor.
A user registers a third-party authentication app to their Digital Identity Management User ID for the second MFA factor.

When the MFA Process executes, Digital Identity Management sends a short form, One-time Passcode (OTP) to the specified (external) channel type. The end user retrieves the OTP and enters it into their client web application for authentication. For more details, see Multi-Factor Authentication. MFA Settings

App Setting	Description	Default
2FA Max Retry Verification	During sign in, this value is the maximum number of retries/attempts a user is allowed for 2FA verification.	5
Verification required for MFA registration	During registration of the MFA method, the end user is prompted to validate the selected channel.	OffNote: Enable this setting by dragging the toggle switch right. The user is prompted to validate on the selected channel on future sign-ins.

Recaptcha

Digital Identity Management supports Google reCAPTCHA(v2, v3, and enterprise) that implements an “invisible” check that analyzes the user’s behavior before a prompt is issued. Configure reCAPTCHA in the Digital Identity Management Admin Console under the Security > Recaptcha page. Recaptcha is off by default and can be enabled by dragging the toggle switch to the right. For more details, see Recaptcha Authentication. Recaptcha Settings Once you’ve enable recaptcha configure the shared keys used between your Digital Identity Management instance and the recaptcha site.

App Setting	Description	Example
Default secret key	The shared key between Digital Identity Management and reCAPTCHA.	6LdcmqIZAAAAAK2mM3exampleBgplL5UAeCg1lrfBg5siUz
Default site key	The site key to use for client side integration.	6LdcmqIZAAAAAHFf4exampleZu7NW30IwJERJKRdYEORwh9

Home

Guides

APIs

User Lockout

Multi-Factor Authentication (MFA)

Recaptcha

​User Lockout

​Multi-Factor Authentication (MFA)

​Recaptcha

User Lockout

Multi-Factor Authentication (MFA)

Recaptcha