Authentication

Primentra uses token-based authentication. Everyone signs in with an email address and a password before they can see any data. When Active Directory sign-in is on, people can use their Windows account instead.

The Primentra sign-in screen(click to enlarge)

First-run setup

When the database holds no real user accounts, Primentra shows a setup screen instead of the login screen.

1. Enter the Email for the first administrator. It becomes the login name.
2. Enter a Display name.
3. Enter a Password of at least 8 characters, or click Generate.
4. Click Create account & continue.

The account is added to the Administrators role and signed in straight away. The setup screen is never shown again while accounts exist.

Sign in

Enter your email and password, then click Sign in.

• Passwords are case-sensitive.
• The eye icon reveals the password so you can check it.
• After a wrong password, the screen reports how many attempts remain before the account locks.
• After signing in you land on the dashboard.

Sign-in has two limits on failed attempts in 15 minutes: 10 for one user name from one address, and 50 for one address over all names. Successful sign-ins are not counted.

Sign in with a Windows account

When an administrator turns on Active Directory sign-in, the sign-in screen offers two choices: Windows account and Primentra account. Choose Windows account, type your Windows user name and password, and click Sign in.

Primentra checks the password with your domain controller. It remembers your choice on this browser.

If your PC is set up for it, the screen shows one button, Sign in with Windows. Click it and you are in, with no typing. The link Sign in with user name and password under the button opens the form. When the button does not work, the screen opens the form and says Windows sign-in did not work. The link Why? next to it tells you what to ask your administrator.

The sign-in screen with the Sign in with Windows button and the link to the form(click to enlarge)

After a wrong password, your user name stays in the field and the password field is empty. Type the password again. After the second failed try, the screen says Still not working? Ask your IT department. Some messages show a reference code. Read the code to your administrator.

• If you do not see the choice, ask your administrator. The Windows form appears only over HTTPS.
• If Primentra says Sign in with your Windows account., your account does not use a Primentra password. Use the Windows account choice.
• To change this password, change your Windows password. Primentra cannot change it for you.

Administrators find the setup steps on the page Active Directory Setup.

The sign-in form with the Windows account choice, the way back to the Windows button, and the user name and password fields(click to enlarge)

One-click sign-in link

A welcome email sent to an account with Must change password carries a one-click link instead of a password. Clicking it signs the user in and goes straight to the Secure your account screen, where they choose a personal password. The application stays closed until they do.

The link is valid for 72 hours and works once. After that the login screen reports:

Ask an administrator to resend the welcome email from the mail icon on the user's row.

Forced password change

When an account is flagged User must change password at next login, the Secure your account screen appears immediately after sign-in. It asks for a new password and a confirmation, nothing else. The current password is not asked again: the user has just signed in with it.

The Secure your account screen, asking for a new password and a confirmation after the first sign-in(click to enlarge)

The flag clears once the new password is saved, so the next sign-in goes straight to the application. The flag works the same way with or without the welcome email: with it, the one-click link opens this screen without a password; without it, the user signs in with the password you gave them first.

Forgot your password

1. Click Forgot password? on the login screen.
2. Enter your email address and click Send reset link.
3. Open the mail and click Reset password.
4. Enter a new password twice and click Set new password.

The link is valid for 30 minutes and replaces any earlier link for the same address. The confirmation message is the same whether or not the address exists, so the screen never reveals which accounts are real.

Requests are limited to 5 per hour per IP address, and reset attempts to 10 per 15 minutes.

A reset changes the password and ends a lock, because the mail proves the mailbox is the person's own. After the reset, the person signs in with the new password.

A disabled user gets no reset mail. The confirmation message stays the same, so the screen does not show whether an account is disabled. A reset link stops working if an administrator disables the account after the mail was sent.

Sign out

Click the gear icon in the top-right corner, then Sign out at the bottom of the menu.

Signing out invalidates the token on the server, removes it from the browser, and returns you to the login screen. Bookmarked URLs redirect to the login screen until you sign in again.

How authentication works

• Passwords are hashed with scrypt and a random salt. Plain text is never stored.
• A successful sign-in returns a random 64-character hex token.
• The token is kept in localStorage and sent as an Authorization: Bearer header on every request.
• Every sign-in, failed attempt, and lockout is written to the audit log.

Related

• Sessions & Timeouts: how long a token lasts
• Account Security: lockout and password rules
• User Management: create accounts and send welcome mail
• Account Recovery: when no administrator can sign in
• Active Directory & SSO: sign in with a Windows account
• General Settings: set the Application URL