salesforce_security_impl_guide

Securing and Sharing Data
Restricting Login IP Ranges in the Enhanced Profile User
Interface
• Partner Portal and Customer Portal users aren’t required to activate computers to log in.
• For more information on API login faults, see the Core Data Types Used in API Calls topic in the SOAP API Developer's Guide.
• If single sign-on is enabled for your organization, API and desktop client users can’t log into Salesforce unless their IP address is
included on your organization’s list of trusted IP addresses or on their profile, if their profile has IP address restrictions set. Futhermore,
the single sign-on authority usually handles login lockout policies for users with the “Is Single Sign-On Enabled” permission. However,
if the security token is enabled for your organization, then your organization’s login lockout settings determine the number of times
a user can attempt to log in with an invalid security token before being locked out of Salesforce.
• These events count toward the number of times a user can attempt to log in with an invalid password before being locked out of
Salesforce, as defined in your organization’s login lockout settings:
– Each time a user is prompted to confirm his or her identity (when a user clicks Email me a verification code for example)
– Each time a user incorrectly adds the security token or time-based token to the end of their password to log into the API or a
client
Restricting Login IP Ranges in the Enhanced Profile User Interface
You can control login access on a user’s profile by specifying a range of IP addresses. When you
define IP address restrictions for a profile, any login from a restricted IP address is denied.
1. From Setup, click Manage Users > Profiles.
2. Select a profile and click its name.
3. In the profile overview page, click Login IP Ranges.
4. Use any of these methods to change login IP address ranges for the profile.
• If you want to add ranges, click Add IP Ranges. Enter a valid IP address in the IP Start
Address and a higher IP address in the IP End Address field. The start and end
addresses define the range of allowable IP addresses from which users can log in. To allow
logins from a single IP address, enter the same address in both fields. For example, to allow
logins from only 125.12.3.0, enter 125.12.3.0 as both the start and end addresses.
• If you want to edit or remove ranges, click Edit or Delete for that range.
• Optionally, enter a description for the range. If you maintain multiple ranges, use the
Description field to provide details, such as which part of your network corresponds to this
range.
EDITIONS
Available in:
• Enterprise
• Performance
• Unlimited
• Developer
• Database.com
USER PERMISSIONS
To view login IP ranges:
• “View Setup and
Configuration”
To edit and delete login IP
ranges:
• “Manage Profiles and
Permission Sets”
Both IP addresses in a range must be either IPv4 or IPv6. In ranges, IPv4 addresses exist in the
IPv4-mapped IPv6 address space ::ffff:0:0 to ::ffff:ffff:ffff , where
::ffff:0:0 is 0.0.0.0 and ::ffff:ffff:ffff is 255.255.255.255. A
range can’t include IP addresses inside of the IPv4-mapped IPv6 address space if it also includes IP addresses outside of the IPv4-mapped
IPv6 address space. Ranges such as 255.255.255.255 to ::1:0:0:0 or :: to ::1:0:0:0 are not allowed. You can set
up IPv6 addresses in all organizations, but IPv6 is only enabled for login in sandbox organizations from the Spring ’12 release and
later.
Important:
• Partner User profiles are limited to 5 IP addresses. If you want to increase this limit, contact salesforce.com.
• The Salesforce Classic app can bypass IP range definitions set up for profiles. Salesforce Classic initiates a secure connection
to Salesforce over the mobile carrier’s network, but the mobile carrier’s IP addresses might be outside of the IP ranges
allowed on the user’s profile. To prevent bypassing IP definitions set on a user’s profile, “disable Salesforce Classic” in the
Salesforce Help for that user.
42