When configuring a User Authentication rule to achieve this, which of the following should you remember?