📘

Note

This article walks you through the steps for configuring global authentication and security settings. If you want to configure organization-level settings, i.e., settings that apply to one organization, see documentation on organization-level authentication settings.
See an overview of organization-level and host-level configuration.

About external providers

---

Automation Suite allows you to configure an external identity provider to control how your users sign in. The following table provides an overview of the different host-level external providers available:

📘

Differences between integrating Azure AD at host-level and organization-level

The host-level Azure AD external identity provider only enables SSO functionality. This means that the user must be manually provisioned into the Automation Suite organization with an email address matching their Azure AD account for them to sign in to the organization.

When organization-level Azure AD integration is configured, users that sign in to the organization through Azure AD (SSO) will be automatically provisioned in the Automation Suite. In addition, logged in directory users can search for other users in Azure AD.

 

Allowing or restricting basic authentication

Basic authentication refers to signing in with the username and password of a local account.

If basic authentication is restricted, your users can only log in with their directory account, as defined in the external identity provider. Otherwise, users can log in with both their local accounts, if any, and their directory accounts.

Configuration levels and inheritance

This option can be configured:

• at the host level, as described below.
  When set at the host level, the setting applies to all organizations and all their accounts, except if the basic authentication setting at the organization or account level was not explicitly set differently.
• for system administrator accounts, as described below.
  Even when all organizations are restricted from using basic authentication, you can allow system administrators only to bypass this restriction.
• at the organization level, as described in Configuring authentication and security.
  If set at the organization level, the organization-level setting overrides the host-level setting for only that organization. The setting for an organization applies to all accounts that belong to that organization, except accounts for which basic authentication is set differently at the account level.
• at the account level, as described in Adding accounts.
  If set at the account level, the account-level setting overrides the host-level and organization-level basic authentication setting for only that account.

Setting basic authentication at the host level

This setting is only available if an external provider integration is enabled at the host level.

When set at the host level, the setting applies to all organizations and all their accounts. Set it according to the preference or recommendation across your company.
For exceptions, basic authentication can also be set at the organization or account level where you want this setting to apply differently.

To allow or restrict basic authentication for all organizations and all accounts, follow the instructions that apply to your user interface settings.

New admin experience

1. Log in to the host portal as a system administrator.
2. Make sure that Host is selected at the top of the left pane.
3. Click Security.
4. Click the Basic sign-in toggle to change if basic authentication is allowed or not.
   • If on (right toggle position, blue toggle), basic authentication is allowed. While allowed, the Allow basic authentication for the host administrators checkbox is available.
   • If off (left toggle position, gray toggle), basic authentication is restricted.
5. Under Basic sign-in, select or clear the Allow basic authentication for the host administrators checkbox.
   • If selected, basic authentication is allowed for system administrators. Even when basic authentication is not allowed through the configuration of an external provider, as an exception, it is allowed for system administrator accounts only.
   • If cleared, basic authentication is not allowed for system administrators either.
6. At the bottom-right, click Save to apply your changes.

Old admin experience

If you are still using the old admin experience:

1. Log in to the host portal as a system administrator.
2. Go to Security Settings.
3. Under External Providers, click the Disable basic authentication for the organizations toggle to restrict or allow sign in using basic authentication:
   • If off (left toggle position, gray toggle), basic authentication is allowed.
   • If on (right toggle position, blue toggle), basic authentication is restricted. While restricted, the Allow basic authentication for the host administrators toggle is available.

4. If you restricted basic authentication, use the Allow basic authentication for the host administrators toggle to choose if you want to allow basic authentications for system administrators, as an exception:
   • If off (left toggle position, gray toggle), basic authentication is not allowed for system administrators either.
   • If on (right toggle position, blue toggle), even though basic authentication is not allowed, as an exception, it is allowed for system administrator accounts only.
5. At the bottom-right of the External Providers section, click Save to apply your changes.

Recovering from lock out

When basic sign-in (basic authentication) is disabled, it is possible to get locked out if you lose access to your directory account.

To recover from this situation, go to https://<FQDN>/host/orchestrator_/account/hostlogin and log in using your basic authentication credentials.

 

Configuring security options

---

The settings you specify here are inherited by all organizations in your installation as default, but organization administrators can overwrite these settings as needed at the level of the individual organization.

To configure security options for your Automation Suite installation:

1. Log in to the host portal,
2. Make sure that Host is selected at the top of the left pane, and then click Security.
   If you are still using the old admin experience, select Security Settings from the options on the left instead. The settings are available in the Security section.
3. Under Basic sign-in, click Edit password policy.
4. Update the settings as needed. See the following sections for details about each option.

Password complexity

📘

Changes that you make to the Password complexity settings do not affect existing passwords.

Account lockout