Configuring Cleo Portal

This section describes how to configure your Cleo Portal system.

You can:

• Provide admin users single-login access to both Cleo Portal and the Cleo Harmony or Cleo VLTrader applications.
• Customize the look and feel of Cleo Portal.

Enabling mixed mode authentication for Cleo Portal

You can allow Cleo Portal users to log in using SAML or local credentials.

Mixed mode authentication is enabled when both SAML and local logins are enabled. When mixed mode authentication is enabled, the Cleo Portal log in page displays a check box labeled Use Company Login, which allows the user to choose the SAML login.

When the user chooses to use SAML login, the Username and Password fields disappear and when the user clicks Log in, the SAML log in page is displayed.

When the user chooses not to use the company login, Username and Password fields are displayed, allowing the user to enter local login credentials.

1. Go to Administration > Users > SAML.
2. Select the Enable SAML login for Cleo Portal users check box and the Allow local login for Cleo Portal users check box. See SAML service provider reference for more information about these parameters.
3. Click Save.

Cleo Portal users will be able to log in using either their company login (SAML) or their local credentials.

Note: You can bypass the Cleo Portal login page and go directly to your SAML login by adding a query string parameter to the /Portal endpoint. The URL should be specified as /Portal?sso=true.

Two-factor authentication

Two-factor authentication (TFA) is available for users. The two-factor authentication security option is available for users in the Privileges tab.

First Time Registration:

The first time a user successfully logs in with TFA required, a notification appears with a username and password stating that an email has been sent to the registered email address with a link to complete the registration.

1. When the email arrives, click the link to navigate to the registration page. On this page, a wizard appears to help set up a client authenticator application. Choose a client authenticator application based on your system's needs. Recommended authenticator applications are Windows Authenticator, Google Authenticator for Android, and Google Authenticator for iOS, but any authenticator application that supports TOTP protocol will work.

   A QR code and text representation of the shared key are presented. These contain the same information. Either can be used to synchronize the client authentication application with Cleo Harmony and Cleo VLTrader.

2. Enter the information into the authenticator application and click Next.
3. The verification step allows the user to test that the authenticator application has been set up properly. To test the application, enter the username, password, and code from the client authenticator application. Click Test. Upon successful verification, a success message appears, and the Finish button is enabled.

The user can now log into the system using two-factor authentication. Navigate to the login page and follow the Daily Use instructions below.

Daily Use:

Enter the username and password and click Log In. A dialog box appears with a field labeled TOTP Code (time-based one-time password).

Enter the code received from the client authenticator application and click Submit Code.

If the code is valid, login is successful.

Resetting TOTP Key:

To the right of the input field in the TOTP Code dialog is a Reset Key link. Clicking this link will deactivate the user's current two-factor authentication setup, send a new registration email to the user's email address, and instruct the user to reregister at login. Follow the first time registration process outlined above to set up the authenticator again.

Setting up single-login access to Admin UI and Cleo Portal

You can configure your system to allow users to log in one time to access both the Web Admin UI and the Cleo Portal UI.

Note: This section applies to the Cleo Harmony and Cleo VLTrader applications only.

Before you begin, you must have a secure port configured for your Local Listener (see Configuring a Local Listener for HTTP), a resource path for Cleo Portal set (see Local Listener Web Browser Service), and admin users available and enabled on your system (see Cleo VLNavigator User Tab.)

Once your system is properly configured, admin users can log in to Cleo Portal via HTTPs, enabling the drop-down menu used to toggle between User mode (Cleo Portal) and Admin mode (Cleo Harmony or Cleo VLTrader).

1. Set up a VLNav connector host.
   1. Go to Hosts > Templates.
   2. Open the Generic folder, right-click the Generic VLNav template, and select Clone and Activate.
      The VLNav host is added to the Active tab.
   3. Enter a name for your new VLNav connector in the Host Alias field.
   4. Click Apply to save your work.
2. Create a new Users host.
   1. If you do not already have an active Users host, go to the Templates tab, open the Generic folder, right-click the Generic Users template, and select Clone and Activate.
      The Users host is added to the Active tab.
   2. Right-click the Users host and select New User Mailbox.

      The New User Mailbox dialog box appears.

   3. Specify an alias for your mailbox and click OK to dismiss the dialog box and display the Login tab.
   4. On the Login tab, select Connector Host from the Authentication > Type field.
   5. Enter a value in the Authentication > Authenticator field.

      This value should be in the format scheme:alias, where the scheme is VLNav and the alias is host you created above.

   6. Optionally, click List Users to view a list of admin users who belong to this group.
   7. Click Apply.
3. Log in to Cleo Portal as one of the users you just configured.

   In the upper-right corner of the page, there is a pull-down menu you can use to toggle between User mode (Cleo Portal) and Admin mode (Cleo Harmony or Cleo VLTrader).

   Note: If you disable all protocols in the Users Privileges tab, an admin that logs into Cleo Portal is immediately redirected to the Web Admin UI and the toggle is not available.

For information about using SAML with Cleo Portal users, see Configuring SAML.

Customizing Cleo Portal

Note: This section applies to the Cleo Harmony and Cleo VLTrader applications only.

You can customize the look of your Cleo Portal by modifying its CSS and replacing certain background and logo graphics files displayed on the login page. 

Customizing your Cleo Portal banner and login page graphics

Note: This section applies to the Cleo Harmony and Cleo VLTrader applications only.

You can modify the custom.css file to customize the look of your Cleo Portal banner and login page.

1. Navigate to <installdir>/webserver/mftportal/styles/ and open custom.css in a text editor.
2. Modify the custom.css file as necessary. Include #top-banner items in the custom.css to affect the banner and #Login items to affect the login page graphics.

   For example, to specify cloud-background.png as the background image for the login page, copy the image to the webserver/mftportal/ directory and include the following in the custom.css file:

   #LogIn { 
          background-image: url(../cloud-background.png); 
   }

   Note: The URL is relative to webserver/mftportal/styles.

   See Cleo Portal CSS customization parameter reference for information about styles you can customize.
3. Save your updates and refresh the Cleo Portal window to see your changes.

Note: If you re-run the installer, the custom.css file is reinstalled with the product and you must make your customizations again.

Cleo Portal CSS customization parameter reference

Use these selectors to control the style of the Cleo Portal.

Note: This section applies to the Cleo Harmony and Cleo VLTrader applications only.

Note: Unless otherwise stated, changes to the height, width, or text size of any element or attribute are not supported.

Setting Cleo Portal system properties