Skip to main content

Authentication

XClarity One requires two-factor authentication using your user credentials and a one-time passcode from an authenticator application. You can configure the authentication methods to use to sign in to the XClarity One portal by clicking Account settings from the user-account drop-down menu in the upper-right corner.

Note
If five consecutive sign-in attempts fail within a 15-minute period or if consecutive sign-in attempts occur too quickly (within 1 second), your user account is locked for 60 minutes.

User credentials​

Your username is your email address.

It is recommended that you use strong passwords of 16 or more characters. By default, passwords for local user accounts must have 8 – 256 characters, including one or more uppercase and lowercase alphabetic characters, numbers, and special characters. Consider the following recommendations when creating passwords.
  • Do not use known passwords obtained from earlier breaches, leaks, or hacks.
  • Do not use dictionary words.
  • Do not use context-specific words, such as the name of a service, an email address, or derivatives thereof.
  • Do not use more than two repetitive or sequential characters (for example, aaa or 123abc).
  • Do not reuse any of the last five passwords.
Note
Passwords for local user accounts must be changed at least every 365 days. You can change your password by clicking Account settings from the user-account drop-down menu in the upper-right corner, and then clicking Account security > Signing in.

Multi factor authentication​

Multi-factor authentication (username and password, plus a one-time passcode) is mandatory by default for all users in the organization to help protect the XClarity One portal against malicious attacks. If multi-factor authentication (MFA) is not already configured through your federated identity provider, XClarity One will provide and manage it automatically.

Note

For XClarity One on-premises, you can disable MFA for all users in an organization by clicking the Edit icon (Edit icon) on the Details panel from the Organization management view and then disabling MFA mandatory for everyone. You can find the MFA status for your organization on the Details panel.

When MFA is mandatory, users are prompted to set up an authenticator application on a personal device and connect to XClarity One to obtain the one-time passcode (OTP) that is required each time you sign in.

When MFA is disabled, users are not prompted to set up an authenticator application or enter an OTP during signin.

The following authenticator applications are supported.

  • FreeOTP

  • Google Authenticator

  • Microsoft Authenticator

If you have authenticator applications set up on multiple devices, you can provide a custom name for each device. When signing in, you can choose which device to use for the one-time passcode.

If you have an active user session and can access your account settings, you can manage your authentication applications by clicking Account settings from the user-account drop-down menu in the upper-right corner, and then clicking Account security > Signing in.

If you no longer have an active web session and you lose the authenticator application or the authenticator token in the application, contact the user administrator for your organization. User administrators can reset the multi-factor authenticator to remove all authenticator applications for another user in the same organization. After your multi-factor authenticator is reset, you must set up a new authenticator application the next time you sign in.

Passkeys​

XClarity One cloud and on-premises portals support passkeys for local users using FIDO2 authentication, providing a secure and convenient alternative to passwords and multi-factor authentication-based sign in. Passkeys use public-key cryptography and are designed to protect your credentials from phishing and credential theft.

Important

  • Passkey authentication is available only in web browser that support FIDO2/WebAuthn.

  • Passkeys in XClarity One are supported only by local users. For corporate users, passkeys must be configured in the appropriate identity provider.

A passkey is FIDO2 credential that allows you to authenticate without entering a password and one-time passcode. The passkey’s private key remains protected by the authenticator and is not shared with the web portal .Depending on your web browser, operating system, and configured authenticator, you can authenticate using face or finger recognition, a device PIN or passcode, or a FIDO2 security key for user verification.

You can manually register a passkey after signing in to the XClarity One portal by clicking Account settings from the user-account drop-down menu in the upper-right corner, clicking Account security > Signing in, and then clicking Set up passkey in the Passwordless section. Following the wizard to complete the registration.

Attention
When using XClarity One on premises, the following requirements must be met before you can register a passkey.

  • The portal host name must be configured using a fully-qualified domain name (FQDN), and you must open the portal using the FQDN (not the IP address). Check without your organization owner.

  • Ensure that the URL for the portal is secure. If the URL shows “Not Secure”, import the XClarity One server certificate into your web browser's list of trusted root certificates authorities (see Importing the XClarity One server certificate into a web browser).

  • If the passkey is lost, you can sign in using your user credentials and one-time passcode (if multi-factor authentication is enabled).

Web sessions​

Each user can have up to five web sessions. When signing in to the sixth session, the oldest session is automatically ended.

A web session expires after 4 hours of active use or after 30 minutes of idle time. When a web session expires, you are signed out automatically and must sign in again to continue your work.

You can view a list of active web sessions and sign out of any unfamiliar sessions. Click Account settings from the user-account drop-down menu in the upper-right corner, and then click Account security > Device activity.

Note
  • If your web browser is set up to use a popup blocker, configure the popup blocker to allow the xclarityone.lenovo.com website.
  • Ensure that you are using one of the following supported web browsers.

    • Chrome 111 or later

    • Microsoft Edge 111 or later

    • Firefox 112 or later

    • Safari 16.4 or later