Security Settings

Configure authentication, session management, and security policies for your Hublvu organization.

Authentication

Password Policies

Configure password requirements for users who don't use SSO:

1. Go to Security Settings
2. Navigate to Password Policy
3. Configure:
   • Minimum length
   • Complexity requirements (uppercase, numbers, symbols)
   • Password expiration period
   • Password history (prevent reuse)
4. Save

Single Sign-On (SSO)

Integrate with your identity provider for centralized authentication.

Supported Providers

• SAML 2.0 (Okta, Azure AD, OneLogin, etc.)
• OAuth 2.0 / OIDC (Google, Azure AD, etc.)

SAML Configuration

1. Go to Security Settings > SSO
2. Select SAML 2.0
3. Enter:
   • Entity ID — Your IdP's entity identifier
   • SSO URL — Login endpoint
   • Certificate — IdP's signing certificate
4. Download Hublvu's metadata to configure your IdP
5. Test the connection
6. Enable SSO

OAuth/OIDC Configuration

1. Go to Security Settings > SSO
2. Select OAuth 2.0 / OIDC
3. Enter:
   • Client ID — From your OAuth provider
   • Client Secret — From your OAuth provider
   • Authorization URL — Provider's auth endpoint
   • Token URL — Provider's token endpoint
   • Scopes — Required scopes (typically openid profile email)
4. Test the connection
5. Enable SSO

Testing SSO

Before enabling for all users:

1. Click Test Connection
2. Complete authentication in the popup
3. Verify user information is correct
4. If successful, enable SSO

Multi-Factor Authentication (MFA)

Add a second authentication factor for enhanced security.

Configuration Options

Setting	Description
Disabled	MFA not available
Optional	Users can enable MFA themselves
Required	All users must use MFA

Supported Methods

• Authenticator apps (Google Authenticator, Authy, etc.)
• SMS verification (if configured)

Enabling MFA

1. Go to Security Settings > MFA
2. Select enforcement level
3. Configure allowed methods
4. Save

Users are prompted to set up MFA on their next login (if required).

Session Management

Session Timeout

Configure how long inactive sessions remain valid:

1. Go to Security Settings > Sessions
2. Set Idle Timeout (e.g., 30 minutes)
3. Set Maximum Session Duration (e.g., 8 hours)
4. Save

Concurrent Sessions

Control whether users can be logged in from multiple locations:

Setting	Behavior
Allow	Multiple simultaneous sessions permitted
Warn	User notified of other active sessions
Prevent	New login terminates existing sessions

Session Termination

Administrators can force logout:

1. Go to User Management
2. Select user
3. Click Terminate Sessions

All active sessions for that user end immediately.

API Security

API Keys

For programmatic access to Hublvu:

1. Go to Security Settings > API Keys
2. Click Create API Key
3. Enter:
   • Name (for identification)
   • Permissions scope
   • Expiration (optional)
4. Copy the key (shown only once)

Key Management

• View active keys and their last used time
• Revoke keys that are no longer needed
• Set expiration for temporary access

IP Allowlisting

Restrict access to specific IP addresses:

1. Go to Security Settings > IP Allowlist
2. Add allowed IP addresses or CIDR ranges
3. Enable allowlisting

warning

Enabling IP allowlisting blocks access from all other IPs. Ensure you include your own IP before enabling.

Security Events

Security-related events are automatically logged:

• Failed login attempts
• Password changes
• MFA enrollment/removal
• SSO configuration changes
• Session terminations
• API key creation/revocation

View these in Audit Logs.

Best Practices

Enable SSO

SSO centralizes authentication in your identity provider, improving security and user experience.

Require MFA for Admins

At minimum, require MFA for users with administrative access.

Set Reasonable Timeouts

Balance security with usability. Aggressive timeouts frustrate users; long timeouts increase risk.

Regular Key Rotation

Rotate API keys periodically. Set expiration dates for temporary integrations.

Monitor Failed Logins

Watch for patterns of failed login attempts that may indicate an attack.

Related Topics

• User Management — Manage users and groups
• Roles & Permissions — Access control
• Audit Logs — Security event tracking