Password rules, lockout after errors and two-factor authentication are set in the System configuration screen (Administration › Instance and operations › Configuration), category Authentication. This screen is reserved for administrators. Each setting is changed with Edit, and History shows its past values. A setting missing from the list is added with + Add, giving its exact key.
Sign-in providers (form, Microsoft 365, Google Workspace, OpenID Connect, open registration) are set elsewhere: see the "Set up sign-in" page.
Password rules
They apply to every new password (registration, change, reset):
| Setting | Default |
|---|---|
Auth:Password:MinLength — minimum length |
8 characters |
Auth:Password:RequireUppercase — at least one uppercase letter |
yes |
Auth:Password:RequireLowercase — at least one lowercase letter |
yes |
Auth:Password:RequireDigit — at least one digit |
yes |
Auth:Password:RequireSpecialChar — at least one special character |
no |
Temporary lockout
After several wrong passwords in a row, the account is locked for a while, then for longer and longer if the errors resume:
| Setting | Default |
|---|---|
auth.lockout.maxAttempts — errors in a row before lockout |
5 |
auth.lockout.durationMinutes — length of the first lockout, doubled at each repeat |
15 minutes |
auth.lockout.maxDurationMinutes — maximum length of a lockout |
1440 minutes (24 hours) |
During the lockout, every attempt is refused without the password being checked, and it does not extend the lockout. The account holder is notified by email. The account keeps the Active status during this lockout: the user list does not show it, and the Unlock button does not appear (it only concerns the Locked status, which no current action sets any more). The lockout lifts by itself at the end of the delay; to lift it at once, reset the password of a local account from user administration.
Two-factor authentication
A user can protect their account with a second factor: a code received by email, by SMS, by either, or given by an authenticator app. They also receive recovery codes, each usable once if the second factor is lost.
Making two-factor authentication mandatory. Set the auth.require2fa setting to true (false by default). It is then required from every account that signs in with a local password; an account without a local password, which only signs in through an identity provider (Microsoft 365, Google Workspace, OpenID Connect), is not concerned. A user who does not have a second factor yet must set one up at their next sign-in. A temporary exemption (30 days at most) can be granted to an account from user administration.
Making two-factor authentication mandatory for administrators only. Set the auth.require2fa.admins setting to true (false by default). It is then required, in the same way, from administrator accounts only: members of the ADMINS or DEVS groups. Other accounts keep the choice, including members of a module's administration groups (for example Service Desk administrators): to require it from them too, use auth.require2fa. An administrator who does not have a second factor yet must set one up at their next sign-in; they can no longer turn it off themselves, and the temporary exemption applies too. The setting has no effect when auth.require2fa is true, which already requires it from everyone. In user administration, an administrator's record shows "required for administrators", as does their profile page.
Settings for codes sent by email or SMS:
| Setting | Default |
|---|---|
auth.2fa.maxAttempts — wrong codes before going back to the sign-in page |
3 |
auth.2fa.resendDelaySeconds — minimum delay between two code sends; the previous code stays valid |
60 seconds |
auth.2fa.maxSendsPerHour — maximum codes sent per account over a rolling hour |
5 |
Trusted devices. With auth.trustedDevices.enabled set to true (false by default), the code entry page offers the "Don't ask again on this device for 30 days" checkbox.
Other settings
Auth:AccessDenied:Contact: text shown on the "Access denied" page to say whom to ask for access (department, email address, link). When empty, nothing is shown.- When an administrator resets an account's password, all open sessions of that account are closed.