Users management
SFTPPlus MFT provides a complete user management system that supports both internal and external authentication sources. This flexibility allows organizations to manage user access efficiently, integrate with existing identity systems, and maintain strong access control across file transfer services.
User Types
SFTPPlus supports two main user types:
- Application users – managed directly within the SFTPPlus configuration.
- Operating system users – accounts defined in the host operating system, including local and domain users.
Using operating system users simplifies migration from legacy systems. Existing credentials can continue to be used without requiring password resets or account changes, while users gain access to modern file transfer services such as SFTP, FTPS, and the Web Interface.
Embedded User and Group Management
SFTPPlus includes an embedded identity management component that allows administrators to define users and groups, with each user being a member of one or multiple groups. Configuration options can be defined at the user level or inherited from the group level, simplifying account management across large deployments.
User management can be performed through:
- The web management interface
- APIs for automation
- Command-line tools
- Direct editing of .INI configuration files
Keep users inside their home folders
Application accounts are always restricted to their configured home folder. This chroot-style boundary presents the home folder as the root directory and prevents the account from browsing other parts of the server's file system.
Operating system accounts can also be locked to their home folder. When they are not locked, access outside the home folder still depends on both SFTPPlus permissions and the native operating system permissions.
Expose selected paths with virtual folders
Virtual folders make a selected directory outside the locked home folder appear at a path inside the user's file transfer session. This allows an account to reach a shared or application directory without exposing the rest of the server's file system.
Virtual folders can be configured directly on an SFTPPlus application account or inherited from one or more groups. Account-level configuration is useful for paths needed by one user, while group configuration keeps shared mappings consistent across a team. Permissions still control whether users can list, read, write, or delete content inside each mapping.
See the file system access documentation for virtual folder and home folder examples.
Control uploaded files
Administrators can limit the size of files uploaded by a user. They can also require every uploaded file to have a unique name, with SFTPPlus automatically prefixing the file name with a UUID.
User email addresses
Each user can have one or more associated email addresses. SFTPPlus can use these addresses for notifications related to that user, such as file transfer events and password or account expiration warnings.
Email addresses are supported for SFTPPlus application users and for users provided through LDAP, Active Directory, or an HTTP API authentication endpoint.
External Authentication Integration
Beyond the built-in user management, SFTPPlus can delegate authentication to external identity providers, including:
- Active Directory
- LDAP
- RADIUS
- OAuth / OpenID Connect providers such as Microsoft Entra ID, Okta, and Google Identity
SFTPPlus also supports integration with custom HTTP-based microservices, allowing it to connect with proprietary or third-party user management systems.
Limit access to selected groups
An SFTPPlus account can be associated with multiple groups. The application users authentication method can use allowed_groups to accept only accounts that belong to at least one of the selected groups.
By default, an accepted account still receives access from all of its associated groups. For example, if an account belongs to an allowed group and another group, permissions and virtual folders from both groups are available after login.
Set strict_group_access = yes when the session should receive access only from the groups selected in allowed_groups. Other group associations remain on the account but do not grant permissions or virtual folders through that authentication method.
See the application users authentication documentation for configuration examples.
Authentication Methods and Security Policies
SFTPPlus supports multiple authentication methods that can be used individually or combined for multi-factor authentication (MFA):
- Username and password
- SSH public keys
- TLS client certificates
- TOTP one-time codes
Advanced security options include:
- Source IP restrictions
- Password policies for length, character classes, known weaknesses, reuse, and expiration
- Automatic suspension of inactive accounts
- Configurable session time limits
Password policies can require lowercase letters, uppercase letters, digits, or symbols. They can also reject weak values, such as a password that contains the account username. These rules apply when administrators set a password and when users change their own password through an enabled self-service method.
These controls help maintain consistent access governance and reduce unauthorized access risks.
Audit and Monitoring
All user activities, including authentication attempts and session details, are fully recorded in the SFTPPlus audit log. Each log entry includes information such as:
- The credentials used (e.g., password, SSH key, certificate)
- Source IP address
- Protocol used (SFTP, FTPS, HTTPS, etc.)
This audit trail supports compliance, monitoring, and security investigations.
Key Benefits
- Flexible identity model: Support for both internal and operating system users.
- Seamless integration: Connects with common enterprise identity systems and custom APIs.
- Strong authentication: Supports multiple and combined authentication methods, including MFA.
- Centralized management: Manage users and groups from the web interface, command line, or API.
- Comprehensive auditing: Tracks all user activity for compliance and traceability.