Account Security
This page is the single home for account lockout and password rules.
Account lockout
Primentra locks an account after 5 consecutive failed sign-in attempts.
While the counter is running, the login screen warns how many attempts are left. On the fifth failure:
- The account is set to inactive.
- The login screen shows: *Account is locked after too many failed attempts. Contact your administrator.*
- An
account_lockedentry is written to the audit log.
A successful sign-in resets the counter to zero.
Attempts against an email address that has no account are logged too, as a failed sign-in with no user attached. A run of unknown addresses from one machine is the clearest sign of an attack there is.
Unlock an account
An administrator can unlock the account:
- Go to Settings → Access Management → Users.
- Open the locked account.
- Tick Active.
- Click Save.
The user can also unlock themselves with the Forgot password? link, if the mail server and the Application URL are configured. Completing a reset reactivates the account and clears the counter.
If every administrator is locked out, see Account Recovery.
Password rules
- Minimum 8 characters.
- A new password must differ from the current one.
- Passwords are hashed with
scryptand a random salt. They are never stored in readable form and can never be shown again.
The Generate button in the user form produces a random 16-character password using upper case, lower case, digits, and punctuation. Characters that are easy to confuse are left out.
Change your password
- Click the gear icon in the top-right corner.
- Click Change Password.
- Enter your Current password.
- Enter the New password twice.
- Click Update Password.
Every other session for your account is signed out. The tab you are working in stays open.
password_changed. A password set after a magic-link sign-in is recorded as password_forced_change.Authentication events in the audit log
All of these are written with entity name Authentication and model System. Filter on the entity name in the audit log to see them.
| Action | When |
|---|---|
login_success | Someone signs in |
login_failed | A wrong password, or an unknown email address |
account_locked | The fifth failed attempt |
logout | Someone signs out |
first_user_setup | The first administrator account is created |
user_created | An administrator creates an account |
user_updated | An account is changed |
user_deleted | An account is deleted |
welcome_email_sent | A welcome email is sent or resent |
password_changed | A user changes their own password |
password_forced_change | A user sets a password after a magic-link sign-in |
admin_password_reset | A password is reset by link or by the recovery tool |
Each entry records the email address and, where known, the IP address.
Related
- Authentication — sign-in and password reset
- Account Recovery — when nobody can sign in
- Sessions & Timeouts — how long a session lasts
- User Management — unlock an account
- Audit Log — read these events