Assisted Login Profiles

Assisted Login Profiles define the rules and participants for approver-based authentication workflows. An approver validates the identity of a requesting user before granting access. Mideye Server supports two profile types: Normal (LDAP-backed) and Federation (identity-provider-backed).

Navigate to Server Settings → Assisted Login Profiles to manage profiles.

Profile List

The list view displays all configured assisted login profiles in a sortable data grid.

| Column | Description | |--------|-------------| | Profile name | Unique name identifying the profile. Default sort column (ascending). | | Federation | Boolean indicator — checked if the profile is a federation profile. | | Action | Edit and Delete buttons (visible to administrators only). |

Creating a Profile

Click the Settings button to choose between:

Add a Normal Profile — creates a profile backed by LDAP directory groups.
Add a Federation Profile — creates a profile backed by an external identity provider (e.g., Entra ID).

The profile type determines which tabs and fields appear in the editor.

Profile Editor

The editor uses a tabbed form. Normal profiles display four tabs; federation profiles display three (the Additional Challenges tab is hidden).

General Tab

Normal Profiles

| Field | Description | Default | |-------|-------------|---------| | Profile name | Unique identifier. Validated asynchronously against existing names. Max 255 characters. | — | | Notification attribute | LDAP attribute used to identify the user in notifications. Max 100 characters. | displayName | | Session timeout | Maximum session duration in seconds. | 120 | | Idle timeout | Inactivity timeout in seconds before the session expires. | 96 | | Groups matching part in CN | When enabled, allows partial matching of group common names. | Disabled |

Federation Profiles

| Field | Description | Default | |-------|-------------|---------| | Profile name | Unique identifier. Same validation as normal profiles. | — | | Resource | Federation resource identifier (e.g., application URI). | — |

Approver Tab

Defines who is authorized to approve authentication requests.

Normal Profiles Only

Approver Id attribute — a multi-tag input specifying which LDAP attributes identify an approver. Default tags: sAMAccountName, mobile, userPrincipalName, mobilePhone, mail, uid. At least one attribute is required.
Require Manager — when enabled, the approver must be the requesting user's manager in the directory.

Both Profile Types

Approver Groups — a dynamic list of group names. For federation profiles, specify groups using the full Distinguished Name.
Approver Identities — a dynamic list of individual approver identifiers. For federation profiles, use userPrincipalName. The value root is explicitly blocked.

User Tab

Defines which users may request assisted login through this profile.

Normal Profiles Only

User Groups — a dynamic list of LDAP group names whose members may request assisted login.

Both Profile Types

User Identities — a dynamic list of individual user identifiers. For federation profiles, specify users with userPrincipalName, domain, or regular expression. The value root is explicitly blocked.

Additional Challenges Tab

Available for normal profiles only. Adds custom challenge questions that the user must answer during the assisted login flow.

Each challenge entry contains:

| Field | Description | |-------|-------------| | Question | The challenge question displayed to the user. Required, max 255 characters. | | Title | Label for the response field. Required, max 255 characters. |

Click the add button to insert a new challenge. Each challenge includes a delete button for removal. The list is scrollable when many challenges are configured.

Permissions

| Action | Required Role | |--------|---------------| | View profiles | Any authenticated user | | Create, edit, or delete profiles | Administrator or above |