Authentication policy

The Authentication screen sets what a password has to be, what happens when somebody guesses wrong, whether a second step is required, and how long being signed in lasts — and shows who is signed in right now.

Open it from Administration → Authentication. The header has Identity providers, which opens identity providers for connecting your own SAML or OpenID Connect directory, and Save policy, which saves every change on the screen at once. The stat strip shows how many people are signed in now, the current min length, and the password expiry (off when passwords never expire).

Every rule here is applied by the server on every sign-in and every password change, not by this screen. An organisation that has never opened it is running on the product’s defaults — the banner “Nobody here has changed these yet, so they are the product’s defaults” says so, and saving without editing anything changes nothing.

What a password has to be

Setting	What it means	Default and limits
Minimum length	The fewest characters a new password may have.	12. Between 8 and 72 — longer than 72 is not offered, because only the first 72 characters of a password are checked, so a longer minimum would be a rule nothing could enforce.
A capital letter	Requires at least one upper-case letter.	Off
A lower-case letter	Requires at least one lower-case letter.	Off
A digit	Requires at least one number.	Off
A symbol	Requires at least one character that is not a letter or digit.	Off

A longer minimum does more than character rules: requiring a capital, a digit and a symbol tends to produce “Password1!” across a whole site. The toggles are here for security standards that demand them. The sign-up and password screens tell people that four unrelated words make a good password.

What it may not be again

Setting	What it means	Default and limits
Previous passwords remembered	How many earlier passwords a new one may not repeat.	0 keeps none. Up to 24. Only hashes are stored.
Keep a new password for at least (hours)	The shortest time before a password may be changed again, so nobody cycles through their history in a minute to get back to an old one.	0. An administrator setting a password is never blocked by this.
Passwords expire after (days)	How long a password lasts.	0 means never. When set, a correct but expired password gets no session — just one chance to choose a new one (“That password has expired”).

When somebody guesses

Setting	What it means	Default and limits
Attempts before locking	Wrong passwords in a row before the account locks. A correct password clears the count.	5. At least 1.
Locked for (minutes)	How long a lock lasts.	1 for a new organisation. An organisation set up before one minute became the default keeps the length it already had. At least 1.
Lengthen each repeat lockout	Doubles the wait each time — with a one-minute lock, 1, 2, 4 — up to a day.	Off, because the usual cause of a second lockout is the same person still not finding their password.

An administrator can clear a lockout early from the banner on the Access screen, which writes an audit entry naming who cleared whose. Resetting a password through the emailed link also clears any lockout.

Whether a password is enough

Two-step sign-in has three settings:

Setting	Effect
Nobody is asked (default)	Nobody is asked for a code, and nobody may set an authenticator up.
Anybody may turn it on	People may set up an authenticator from their own profile, and whoever has is asked for a code. Start here before requiring it.
Everybody	Everybody signing in with a password is asked for a code. Anybody who has not set one up is asked to, at the sign-in screen — nobody is locked out.

Setting	What it means	Default and limits
Recovery codes per person	How many one-time recovery codes a person is given when they enrol.	10. At least 5. Each signs in exactly once, and they are the way back from a lost phone that does not need an administrator.

Enrolling shows a QR code for an authenticator app and the recovery codes, once. An administrator can see who is enrolled, and clear somebody’s authenticator, from the Two-step sign-in panel on the Access screen.

Two-step sign-in governs password sign-ins only. People arriving through an identity provider are not asked again here — their second factor lives with their provider, administered by their own security team.

How long being signed in lasts

Setting	What it means	Default and limits
Signed out after inactivity (minutes)	How long a session lasts without activity. This is the real lifetime of the session, enforced by the server, not a timer in the browser.	30. At least 1.
Signed out regardless after (minutes)	The absolute limit, however active somebody has been. A handset follows it only when it may not extend its session; when it may, the next setting applies to it instead.	720 — twelve hours, so a full maintenance shift is never interrupted. At least 1.
Let a handset extend its session	A handset that reaches the network renews its session, so somebody using the field app is not signed out on a schedule they cannot see.	On. Off, a handset’s session lasts the limit above from sign-in and a technician signs in once a shift. With it on, a handset nobody is holding is stopped by revoking the device rather than by the clock. It changes nothing on the web.
A handset stays signed in for (days)	How long a handset stays signed in, counted from the last time it reached the server.	90. 1 to 365. Greyed out while Let a handset extend its session is off, because a handset then lasts the shift. A technician who opens the field app at least this often is never asked to sign in again; the device passcode protects what is held on it. A lost handset is stopped at once — by ending its sessions below, or by its owner revoking the device — not by waiting for this to run out.
Sessions at once, per person	How many sessions one person may hold. Over the limit, the oldest ends — so somebody whose tablet died can always sign in on the replacement.	0 means no limit.

If the inactivity window is set longer than the absolute limit, the screen warns that every session would end before its first renewal, and saving is refused.

Who is signed in

A register of sessions, newest first, with a count of how many are live out of those shown.

Column	What it shows
Person	Name and sign-in address
Where	Browser, or the name of the device for a handset session
Signed in	When the session began
State	Live until the time it will lapse, or Ended with the reason in words — revoked, its handset was revoked, too many sessions at once, switched to another organisation or the account was switched off

End on a live row ends that session: the next request it makes is refused, not merely its next renewal. For a lost handset, End each of its sessions here; if the handset must not be able to sign in again, suspend the account as well. The device itself is revoked by the person it is enrolled to, from Your devices → I no longer have this on their profile. That ends its access at once and asks it to destroy the copy of their work it holds — anything it had queued and not sent is lost. Signing out of the field app ends that handset’s sessions in every organisation it holds.

Who can use this screen

To	Permission (as the grid shows it)
Change the policy	Authentication · admin — kept apart from general configuration on purpose
See who is signed in	User · view
End a session	User · edit

Somebody who can open the screen but not change the policy sees the values read-only, with a note saying so. See the permission reference.

Setting up

Configuration

What a password has to be

What it may not be again

When somebody guesses

Whether a password is enough

How long being signed in lasts

Who is signed in

Who can use this screen