Security Implementation Guide

Clouds with binary code floating aboveCloud with binary code floating above

No Results

Search Tips:

  • Please consider misspellings
  • Try different search keywords
PDF

Newer Version Available

This content describes an older version of this product. View Latest

Setting Login Restrictions

Available in: All Editions

To help protect your organization’s data against unauthorized access, you have several options for setting login restrictions.

Login Hours
For each profile, you can set the hours when users can log in. See:
Two-Factor Authentication for User Interface Logins
For each profile, you can require users to enter a time-based token as a second form of authentication when they log in via the user interface. See Setting Two-Factor Authentication Login Requirements.
Two-Factor Authentication for API Logins
For each profile, you can allow the use of a time-based token to access the service instead of the standard security token. If users add a time-based token to their account and this permission is enabled, they must use this token instead of the standard security token whenever it’s requested, such as when resetting the account’s password. See Using Two-Factor Authentication for API Access.
Login IP Address Ranges
For Enterprise, Performance, Unlimited, Developer, and Database.com editions, you can set the Login IP Range addresses from which users can log in on an individual profile. Users outside of the Login IP Range set on a profile can’t access your Salesforce organization. See:

For Contact Manager, Group, and Professional Editions, set the Login IP Range in Setup, Security Controls | Session Settings.

Organization-Wide Trusted IP Ranges
For all users, you can set a list of IP address ranges from which they can always log in without receiving a login challenge. These users can log in to your organization once they provide the additional verification. See Set Trusted IP Ranges for Your Organization.
When users log in to Salesforce, either via the user interface, the API, or a desktop client such as Connect for Outlook, Salesforce for Outlook, Connect Offline, Connect for Office, Connect for Lotus Notes, or the Data Loader, Salesforce confirms that the login is authorized as follows:
  1. Salesforce checks whether the user’s profile has login hour restrictions. If login hour restrictions are specified for the user’s profile, any login outside the specified hours is denied.
  2. If the user has the “Two-Factor Authentication for User Interface Logins” permission, Salesforce prompts the user for a time-based token (which the user may also be prompted to create if it hasn’t already been added to the account) upon logging in.
  3. If the user has the “Two-Factor Authentication for API Logins” permission and a time-based token has been added to the account, Salesforce returns an error if a time-based token is not used to access the service in place of the standard security token.
  4. Salesforce then checks whether the user’s profile has IP address restrictions. If IP address restrictions are defined for the user’s profile, any login from an undesignated IP address is denied, and any login from a specified IP address is allowed.
  5. If profile-based IP address restrictions are not set, Salesforce checks whether the user is logging in from an IP address they have not used to access Salesforce before:
    • If the user’s login is from a browser that includes a Salesforce cookie, the login is allowed. The browser will have the Salesforce cookie if the user has previously used that browser to log in to Salesforce, and has not cleared the browser cookies.
    • If the user’s login is from an IP address in your organization’s trusted IP address list, the login is allowed.
    • If the user’s login is from neither a trusted IP address nor a browser with a Salesforce cookie, the login is blocked.
Whenever a login is blocked or returns an API login fault, Salesforce must verify the user’s identity:
  • For access via the user interface, the user is prompted to enter a token (also called a verification code) to confirm the user’s identity.

    Users aren’t asked for a verification code the first time they log in to Salesforce.

    Note

  • For access via the API or a client, users must add their security token (or time-based token if Two-Factor Authentication on API Logins is set on the user’s profile and the user has added a time-based token to his or her account) to the end of their password in order to log in.

    A security token is an automatically-generated key from Salesforce. For example, if a user’s password is mypassword, and the security token is XXXXXXXXXX, then the user must enter mypasswordXXXXXXXXXX to log in. Or, some client applications have a separate field for the security token.

    Users can obtain their security token by changing their password or resetting their security token via the Salesforce user interface. When a user changes their password or resets their security token, Salesforce sends a new security token to the email address on the user’s Salesforce record. The security token is valid until a user resets their security token, changes their password, or has their password reset.

    We recommend that you obtain your security token using the Salesforce user interface from a trusted network prior to attempting to access Salesforce from a new IP address.

    Tip

Tips on Setting Login Restrictions

Consider the following when setting login restrictions:
  • When a user’s password is changed, the security token is automatically reset. The user may experience a blocked login until he or she adds the automatically-generated security token to the end of his or her password when logging in to Salesforce via the API or a client.
  • Partner Portal and Customer Portal users aren’t required to activate computers to log in.
  • For more information on API login faults, see the Core Data Types Used in API Calls topic in the SOAP API Developer's Guide.
  • If single sign-on is enabled for your organization, API and desktop client users can log into Salesforce unless their profile has IP address restrictions set, and they try to log in from outside of the range defined for that profile. Furthermore, the single sign-on authority usually handles login lockout policies for users with the “Is Single Sign-On Enabled” permission. However, if the security token is enabled for your organization, then your organization’s login lockout settings determine the number of times a user can attempt to log in with an invalid security token before being locked out of Salesforce.
  • These events count toward the number of times a user can attempt to log in with an invalid password before being locked out of Salesforce, as defined in your organization’s login lockout settings:
    • Each time a user is prompted to confirm his or her identity (when a user clicks Email me a verification code for example)
    • Each time a user incorrectly adds the security token or time-based token to the end of their password to log into the API or a client