Users, accounts, groups, auth & policies#
Accounts represent the users that are managed by SFTPPlus and are available to authenticate for file transfers. This differentiate them from Active Directory users, LDAP users, or operating system users, which are managed by external systems and are not created or managed by SFTPPlus. Both SFTPPlus accounts and externally authenticated users can be used to authenticate for file transfers.
Multiple accounts can be associated with a group, which allows for easier management of permissions and access control.
An authentication method configuration provides the required information to allow SFTPPlus to use a specific method in order to authenticate file transfer users and administrators.
Note
Not all authentication method types support authenticating the administrators for the Web Manager service.
The sections below will guide you through the available authentication methods and how to configure them.
This section shows you how to create a new authentication method using the Web Manager console or the configuration file.
Enforce password security, prevent brute-force attacks and restrict or allow access based on source IP address using security policies.
Learn how password policies are implemented, about authenticating with Windows Domain users, anonymous authentication and other authentication settings.
Learn about the available permissions that can be applied to different files and folders.
Learn about the differences between application accounts and operating system accounts and the configuration options available for each.
Learn about the Default Group and how to add and manage new groups in SFTPPlus.
An application authentication method can be used to authenticate users based on the accounts defined in the SFTPPlus main configuration.
Authenticating OS users is possible in SFTPPlus using the os authentication method. This section covers how to configure it and the available options.
A remote HTTP web service can be used to authenticate users in SFTPPlus. This section covers how to configure the HTTP authentication method and the available options.
The local file authentication method allows SFTPPlus to authenticate users defined in a separate configuration file. This section covers the available options for it.
The LDAP authentication method allows SFTPPlus to authenticate users against an LDAP or Active Directory server. This section covers the available configuration options.
This section provides information about configuring SFTPPlus to use LDAP for users and administrator authentication in various use cases.
The Entra ID authentication method allows SFTPPlus to authenticate users against Microsoft Entra ID (formerly Azure Active Directory). This section covers the available configuration options and how to set it up.
The google-identity method is used to implement single sign-on authentication using the Google Identity service, allowing Google Workspace users to authenticate in SFTPPlus as administrator or file transfer users.
The okta-oidc method is used to implement single sign-on authentication using the Okta OpenID Connect service, allowing Okta users to authenticate in SFTPPlus as administrators or file transfer users.
The radius authentication method can be used to authenticate application type users by delegating the authentication to a remote RADIUS UDP server.
This is provided for backward compatibility. Use the security policies to restrict access based on username. This authentication method can be used to block/deny authentication for a configured list of users or administrators.
This is provided for backward compatibility. Use the security policies to restrict access based on source IP. This authentication method can be used to block/deny authentication requests coming from a specific IP address helping to mitigate DDOS attempts to SFTPPlus services.
This is provided for legacy FTP compatibility. This method can be used to authenticate a specific application users by ignoring the provided password or any other credential.