Skip to main content
The auto-login link grants end-users access to their quarantined emails in the SSQ, under the xcc_quarantine_user role, see Roles.

​
Quickstart

The following steps will enable Auto-Login links:
  1. In the Expert Editor, open /shared/guarded_tenants.yml.
  2. Add the following configuration:
    • Include the autoLoginLink block for each tenant.
    • Set enabled to true to include an auto-login link in all quarantine notification emails.
    • Set enabled to false to disable the feature.
    • expirationDays defines the validity period of the authentication link.
    • The default of expirationDays is 7 days.
    • To make links permanent, set expirationDays to -1.
    /shared/guarded_tenants.yml
  3. Click Publish. The Auto-Login configuration becomes active within about one minute.
  4. Now all quarantine notifications will contain Auto-Login links.
For testing purposes, you can generate a link to access a specific mailbox in the SSQ. Prerequisites:
  • You need the xcc_user_impersonate permission, which is granted by the admin role
  • autoLoginLink needs to be enabled, as shown above
Access this URL in your browser to get the token:

​
Trigger a notification

You can trigger an artificial quarantine notification to a specific mailbox, helping users regain access to the SSQ: Prerequisites:
  • You need an active, signed-in xorlab administrator session in the same browser. This endpoint is not publicly accessible and cannot be called anonymously.
  • autoLoginLink needs to be enabled, as shown above, for the notification to contain an access link.
Use with careThe notification is delivered to whichever mailbox you specify, and depending on the tenant configuration it may contain a valid Auto-Login link for that mailbox. Only trigger it for mailboxes you are entitled to access.

​
Additional information

​
Compatibility with Authentication Methods

The Auto-Login Authentication method is compatible with other authentication methods, including SAML, LDAP, and password-based authentication. This allows organizations to provide seamless access to quarantined emails for end-users while preserving existing authentication mechanisms for roles with elevated permissions. No configuration changes are needed in /auth/auth/auth.yml to enable this feature. When enabled, the auto-login token is included in all quarantine notification emails. It is not possible to restrict the Auto-Login Authentication method to specific user groups—once activated, all users receiving quarantine notifications will have access through the auto-login link.

​
Access for Elevated Roles

When users with elevated roles—such as analysts or administrators—receive a quarantine notification for their own quarantined emails, they can use the auto-login link to access their Self-Service Quarantine. However, this authentication method does not grant access to the Analyst Dashboard, Admin settings, or other privileged areas of the platform. To access these administrative features, users with elevated roles must first sign out and re-authenticate using their primary authentication method, such as SAML or LDAP. This ensures that privileged actions remain protected under stricter authentication controls, maintaining security while still allowing convenient access to quarantined emails.

​
Multi-Tenancy

The autoLoginLink block shown above is configured per tenant, so in a multi-tenant deployment you can enable Auto-Login for some tenants and not for others, and give each tenant its own expirationDays. Auto-Login is our recommended way to give the end-users of a tenant access to their SSQ, because it requires no integration with the tenant. See Enable Tenant Login for a per-tenant example.