Login Tracking

You can track information about concurrent logins, authentication history, and your last login by adding properties to the customer_overrides.properties.in file, and then running the setupfiles command.

Important: If Sterling B2B Integrator has the Sterling File Gateway feature installed, do not enable these features. The login data currently provided by Sterling File Gateway does not mention Sterling B2B Integrator and is intentionally filtered out of the authentication history displayed on the Sterling B2B Integrator dashboard UI.
  • To enable concurrent login checking, add noapp.enableConcurrentLoginCheck=true.

    If you enable concurrent login checking, you also need to enable authentication history. The concurrent login alert will direct users to verify authentication history if there are other active sessions. This will help you identify possible breaches in your account.

  • To enable authentication history pages and links, add noapp.enableAuthenticationHistory=true. This adds an Authentication History link to:
    • Your account page (Accounts > My Account)
    • The Mailbox Search menu
    • The AS2 File Tracking menu

    The authentication history includes both password and cookie authentication. It also shows authentication failures.

  • To track the last login by a user, add noapp.enableLastLoginDisplay=true. This displays under the Hello message the last login date and time, along with the IP address where the login occurred.

Other considerations when using these features include:

  • If a user is logged in on two different nodes of a cluster, that is considered a concurrent login.
  • Continuing sessions to a web application (mailbox, dashboard, ws) where you have already authenticated to that application are not treated as a new authentication. Those sessions will not have authentication history records added even if the session is continued with a new browser window or tab.
  • Concurrent login alerts can be displayed if your previous session was terminated without a logout (for example, by closing the browser) and the session timeout period has not yet expired.
  • Concurrent login alerts can be displayed in the following login situations:
    • SSL with the SSL <base port+1> port
    • From Sterling Control Center
    • From Sterling Secure Proxy
    • LDAP-authenticated user
  • When you run the purge service, all of the session records that are the last login records for any user are retained, regardless of age. With other records, only the records newer then the purge period are retained.