Authentication and credential authorization for MOVEit Transfer is a popular subject as many administrators aim to secure their servers while simplifying access for their users. Two common methods of authentication or credential submitting are SAML protocols and the credential replication options provided by the Auth Methods settings. Adding Multi-factor authentication into the mix, and administrators have a lot of choices for how their users log in securely, and it can be daunting to map out the appropriate process for any given team. The documentation about the User Authentication Settings is available here . This guide will clarify the function of these options as administrators seek to use them in their Transfer Configurations. 

To start, below is a summary of the general options available and how they function: 

External Authentication Methods - Authentication sources like Radius, WS-Trust and LDAP provide a way for MOVEit Transfer to replicate the user store on (typically) a Windows machine. The user store replicates inside the MOVEit Transfer database, and the users accounts reflect what exists on the source (e.g. AD). User Groups in the source may help provide easy management of users' permissions with the Transfer Group Mask options replicated in the setup. LDAP also has the ability to report or correct differences in Group membership with a task available. 

SAML and Single Sign-On - SAML allows Transfer to trust a third party store of user accounts, and bypass the general credential submittal process by outsourcing the authentication to a particular third-party source that spans a domain or network. The authentication for SAML occurs entirely outside of Transfer, and then the user seemlessly lands on the Transfer website. A growing variety of Federated Identity Providers can provide this service, but the most common are Okta, Shibbolith, ADFS and OneLogin. Different providers will have slightly different specifics one how the assertion works, and these Configuration Notes will be helpful to identify some details about common providers as you will need to prepare them for Transfer as a SAML Relaying Party. The critical component about this is the Metadata XML file that maps the users for your Transfer instance with a login, email and username attribute designation in the Federated Identity Provider User Settings . Encryption and Signing SSL Certificates ensure the third party authentication assertion is secure. 

Multi-Factor Authentication - MFA  provides an added layer of security to your authentication process by delivering a changing code to users when they attempt to sign on. In addition to their public Username and private Password, MFA seeks to add security by physically verifying they are authentic with a PIN code delivered by Email or a Cellphone Application. User classes can be required or given the option to use MFA.

N/A

Many administrators ask about combining two or more of these options, and need specifics about how users would experience their credential workflow with new configurations. Each of these generally function indepently of one another, and in some cases cannot be combined or will not be used at the same time. 

SAML, in particular, causes the authentication process to occur outside of Transfer so the other two are mostly irrelevant to the user's experience when they sign in through SAML.

• SAML users will bypass the Authentication Method settings in which the user base on LDAP, Radius, or WS-TRUST replicate their users in Transfer. ADFS is the key exception as an option of SAML essentially provides a combination of LDAP as a user base replication along with the third-party credential assertion to give access. 
• Server administrators and SAML Providers can use Multi-factor authentication options through the SAML Provider to add the physical authentication layer, but the MFA options in Transfer will not apply to users authenticating with SAML. 
• There is also not a way to disallow SAML users from signing on through the traditional local Login page, and they will always be able to submit Transfer credentials here. 

External Authentication methods like LDAP allow users to login with the same credentials they use for their AD servers. Their password from AD gets replicated to the Transfer Database entries for users. 

• External options provide for ways that the user can have MOVEit credentials if they do not ahve a designated AD login. This provides simplicity for temporary or external users that are not part fo the domain for AD. 
• Logins go through the standard Transfer Login portal, which means the MFA feature can work with Authentication Methods because the physical code delivery may still happen for authentication and the user experience would present the code input behind the standard Login.