We live in a world where security is more important each day to your organization and your clients.
Securely sign into iTop with multi-factor authentication.
This can be done using an app of your choice (Authy, Authenticator browser extension, Google and Microsoft Authenticator, …); or iTop can be configured to somehow (typically by e-mail) send a message to the user containing the OTP code.
It’s completely independent, so no need to set up a SAML or OpenID integration. Furthermore, any of your customers can just keep using their typical iTop accounts.
As for whitelisting, this two-factor solution also allows whitelisting IP addresses and remembering the browser for a certain amount of days.
The latest version now also supports sending the verification code by e-mail to the user! (Or use a custom action, perhaps you have an API to send an SMS instead?)