Advanced Setting

1. Role-Based Multi-Factor Authentication (MFA)

The Role-Based MFA feature allows administrators to enforce two-factor authentication selectively based on user roles.

Purpose

Role-Based MFA provides flexibility in how two-factor authentication is applied across different user groups. Instead of enforcing MFA for all users, administrators can choose to require it only for users with specific roles such as administrators, managers, or content publishers.

How to Configure

In the Advance Settings > Role-Based MFA section:

• A list of user roles is displayed (e.g., Registered, Author, Editor, Manager, Administrator).
• Administrators can enable or disable MFA for each role by checking or unchecking the boxes.
• MFA will only be triggered for users who belong to one or more of the selected roles. If a user does not belong to any group, MFA would not be triggered for them.

This targeted approach helps balance security and user convenience, making it ideal for systems with multiple permission levels.

2. IP-Based Multi-Factor Authentication (MFA)

The IP-Based MFA feature allows administrators to bypass two-factor authentication for users accessing the system from specific, trusted IP addresses. This is useful for internal networks or secure office environments where additional verification may not be necessary.

Purpose

To improve user experience without compromising security by exempting known IP addresses (such as internal office networks or VPNs) from MFA requirements.

How It Works

Located under Advance Settings > IP-Based MFA.

• When "Whitelist IP Addresses" is enabled, users logging in from the specified IPs will not be prompted for two-factor authentication.
• IPs must be entered in the provided textbox using:
  • Semicolon (;) to separate multiple IPs.
  • Range format for IP blocks: lower_range - upper_range.

3. Custom Settings

1. Redirect user after login: Set a specific URL where users will be redirected post-login (frontend only).
2. Custom Xecurify domain: Define a custom branding domain (set from the Xecurify Dashboard).
3. Google Authenticator account name: Customize the account label shown in the Google Authenticator app.

4. Domain Based MFA

The Domain-Based MFA feature allows administrators to enforce two-factor authentication only for users with email addresses from specific domains. By enabling the checkbox and entering a list of domains (separated by semicolons), MFA will apply exclusively to users whose email ends with those domains—for example: abc.com; xyz.org;.

5. Email Notification Setting

This feature allows administrators to enable email alerts for Two-Factor Authentication (TFA) events. When "Enforce Email Functionality" is checked, an email is sent after a user successfully completes MFA and logs in. The email includes details such as the authentication method used and the username.

Notifications can be configured to be sent to the user, the site administrator, or both based on the selection in the "Send mail to" dropdown.

To enable email delivery, make sure SMTP is properly configured.