Account Security

This page is the single home for account lockout and password rules.

Account lockout

Primentra locks an account after 5 consecutive failed sign-in attempts.

While the counter is running, the login screen warns how many attempts are left. On the fifth failure:

• The account is marked Locked out. Enabled does not change.
• Every open session of the account ends.
• The login screen shows: Too many attempts. Try again in 30 minutes.
• The owner gets one mail: Someone typed a wrong password 5 times for your Primentra account. It is locked for 30 minutes. If this was not you, tell your administrator.
• An account_locked entry is written to the audit log.

A successful sign-in resets the counter to zero.

Attempts against an email address that has no account are logged too, as a failed sign-in with no user attached. After five wrong tries the answer is the same Too many attempts. Try again in 30 minutes. as for a real account, so the screen does not show which addresses exist. A run of unknown addresses from one machine is the clearest sign of an attack there is.

Unlock an account

Every account unlocks itself 30 minutes after the lock, like the lockout duration in SQL Server. The next sign-in after that clears the lock and the counter, and writes account_unlocked with automatic after 30 minutes. A wrong password then counts from zero. This way nobody can lock a person out for good by typing wrong passwords at an address.

A lock can also end sooner. The person sets a new password with Forgot password?, or an administrator clears it:

1. Go to Settings › Access Management › Users.
2. Open the account that shows the Locked out badge.
3. Untick Locked out.
4. Click Save.

The failed-attempt counter goes back to zero and an account_unlocked entry is written to the audit log.

The Forgot password? link stays visible while the account is locked. The lock ends when the person sets the new password, not when the mail arrives.

Disabled accounts

An administrator disables an account by clearing Enabled. The login screen shows Account is disabled. Contact your administrator. A disabled user gets no reset mail. Only an administrator can enable the account again. See User Management.

If every administrator is locked out, see Account Recovery.

Users linked to Active Directory

Three rules hold for a user who is linked to an Active Directory (AD) account. The set-up is on the page Active Directory Setup.

AD switches off, an administrator switches on

When AD says an account is disabled, expired or deleted, Primentra clears Enabled for the user and ends every open session. Primentra does this at sign-in and in the daily check.

AD never switches a user on. When AD says the account is fine again, the user stays off. Only an administrator ticks Enabled again. The Users list marks such a user with Enabled in AD, switched off here.

AD passwords and Primentra passwords

The setting Users who are linked to AD may also use their Primentra password is on by default. You find it in Settings › Access Management › Sign-in, in the part Primentra password.

• On: a linked user can use the Windows password or a Primentra password. After a good Primentra password Primentra still asks AD, so a disabled AD user does not get in.
• Off: a linked user signs in through AD only. Forgot password? sends no mail and Change Password is hidden.

When an administrator turns AD off, this setting no longer applies. Every user signs in with a Primentra password. A user that AD created has none and uses Forgot password? to set one.

Locks

The lock after five wrong passwords guards the Primentra password only.

• The Windows sign-in still works for a locked user.
• A session that started with a Windows sign-in stays open when the account gets locked.
• A wrong Windows password never counts toward the five. It has its own limit: 3 wrong passwords per user name in 30 minutes. After that Primentra stops asking AD for that name until the 30 minutes have passed.
• A lock ends after 30 minutes, when the person sets a new password, or when an administrator clears it. AD never clears a lock.

Password rules

• Minimum 8 characters.
• A new password must differ from the current one.
• Passwords are hashed with scrypt and a random salt. They are never stored in readable form and can never be shown again.

The Generate button in the user form produces a random 16-character password using upper case, lower case, digits, and punctuation. Characters that are easy to confuse are left out.

Change your password

1. Click the gear icon in the top-right corner.
2. Click Change Password.
3. Enter your Current password.
4. Enter the New password twice.
5. Click Update Password.

Every other session for your account is signed out. The tab you are working in stays open.

Authentication events in the audit log

All of these are written with entity name Authentication and model System. Filter on the entity name in the audit log to see them.

Active Directory adds seven more events, such as ad_linked and ad_check_run. They are listed on the page Audit Log.

Each entry records the email address and, where known, the IP address.

Related

• Authentication: sign-in and password reset
• Account Recovery: when nobody can sign in
• Sessions & Timeouts: how long a session lasts
• User Management: the Enabled and Locked out flags
• Active Directory & SSO: the Windows account sign-in