Vindicia External User Authentication Requirements

In order to enable external user authentication to afford SSO access to your users for Subscribe or Retain, the following requirements must be met:

A corresponding user must exist in the Subscribe/Retain solution.
- The corresponding user in Subscribe/Retain and in the IDP system must be defined with a matching email address.
- User authorization governing the user’s role is governed by Subscribe/Retain portals.
The IDP passwords and settings in use must meet PCI password requirements and Vindicia’s recommended settings, including:
- Multi-factor authentication is enabled.
- Re-authentication is required for Subscribe, if logged out or idle for longer than 15 minutes.
- Use of complex passwords including 8 characters and at least one of each of the following:
  - Lower Case Letter
  - Upper Case Letter
  - Number
  - Special Character (!@#$%&*)
- Vindicia strongly recommends use of an OTP client as the preferred Multi-factor authentication method such as Google Authenticator.
- Do not allow use of the users’ last 5 passwords.
- Passwords must be changed every 90 days
Vindicia accepts an authorization code. The authorization code will be the expected method to grant access.
Vindicia requires the client id, secret and domain in order to authenticate the authorization code. Send these in an encrypted format once setup is complete.