Logon Restrictions

Company > Users > Users > Logon Restrictions

Logon restrictions provide an additional level of security beyond normal authentication in that they require the user to access Medallia Web reporting from a specific Internet location. Users that attempt to access the system from another location are rejected, even when they have authentic account credentials.

These restrictions apply when the user signs-in to the system, and are reevaluated throughout the session: if an administrator changes these restrictions while users are signed in, the change could potentially cause the users to be automatically signed-out.

These restrictions do not apply when the user impersonates another user (see Switch account), and the target user does not have permission to sign in from the impersonating user's address.

Important: A user who switches to an account that does not pass these sign-in restrictions is immediately signed-out of Medallia Web reporting.

Properties

Internal Admin IP allow-list
Allow-list for administrator accounts with the Do Anything (administrator) capability.
Important: Use this option only when you need to allow-list users whose primary role has "Do anything" capability. Otherwise, apply restrictions on a per-role basis.
End User IP allow-list
Allow-list to apply to all Users regardless of their primary role. See IP allow-list processing order, below, for more information.
Important: When using this option, only users with IP addresses listed here will be able to access the system; ALL OTHER IP ADDRESSES WILL BE BLOCKED.
Note: When using single sign-on, this list can affect what screen a user sees when attempting to log in. See Login screen behavior for details.
Password reset link expiry duration
Count of hours password-reset links are valid: both for new-user password links and for reset links. The default is 48 hours; the minimum is 1 hour. Password reset links are created and sent to users with the Email user a new password button on the Users screen. Only the most recent link is valid (when multiple links are sent within the expiry duration).
Max Concurrent Sessions
Count of concurrent active sessions each account may have; default: unlimited. When a user tries to initiate a session that exceeds this limit, the user is directed to an error page asking them to close other sessions first. This applies to Single sign-on (SSO) and web sign-on.
Show explicit account recovery errors
Shows error messages when a user enters an invalid username or email while trying to recover the name or password on the "Forgot your account details screen". This is a poor security practice and not recommended because hackers can use this method to identify valid usernames or email addresses.

When off (default) and the user submits an invalid username or email, the system shows a generic message indicating the recovery information was sent to the account's email, if any. There is no indication when the username or email is invalid.

IP allow-list format

A allow-list is one or more IP addresses in full or subnet notation. Enter each address on a line by itself. Blank lines are ignored. Lines starting with octothorpes (#) are comments and also ignored. An empty list is ignored.

Warning: A list with any text — including just comments — causes allow-list -evaluation and will cause a rejection because the User's IP address does not match the "text".

Subnet notation says the first n bits of the number must match the same bits in the given address. For example, 10.0.0.0/24 says the first 24 bits must match, which translates to any address in the 10.0.0.* subnet. Similarly, 10.0.0.0/16 says any address in the 10.0.*.* subnet.

Example list:

# Specific, full address
127.0.0.16
# Two subnets
192.168.0.0/16
10.0.0.0/24

IP allow-list processing order

The Logon Restrictions use the IP allow-lists as follows:

  1. When the user has the Do Anything capability, the user is approved as an administrator when:

    1. The user's IP address matches the Admin IP Allow-list, or

    2. The Admin IP Allow-list is empty (not defined).

  2. Otherwise, the user is approved when:

    1. The User IP Allow-list is defined and the user's IP address matches, or

    2. The user's primary role has a defined IP Allow-list and the user's IP address matches, or

    3. When both lists are empty (both not defined).

  3. Otherwise, the user is not approved and is signed-out.

Flow chart of IP allow-list processing

Allow-listing hosts within the same Medallia data center

When using IP allow-listing and systems within the same Medallia data center must communicate with each other, such as when Omni Exporter sends data to a Web Feed (Auto Importer), include the Class A Private addresses in the data center by adding this CIDR block:

10.0.0.0/8