Authentication

Search2o has built-in authentication with email and password. An administrator sets the session and password rules to the organization's requirements on the Admin › Authentication page. People can also sign in through your identity provider with single sign-on, alongside password sign-in or instead of it.

Sessions

A browser sign-in creates a session held in an HTTP-only cookie. The session ends after a period of inactivity, and in any case after a maximum lifetime; the defaults are one hour and twelve hours. A change to any of these affects a signed-in user only when that user signs in again. See Authentication in the REST API for how clients sign in.

Passwords

The password policy sets the length and the character classes a password must contain, and is enforced on every new password. Users can be made to change their password after a number of days. A password reset signs out every session of that user.

Restricting who can be added

With an allowed email domain set, only addresses in that domain can be added as users. The domain is best set before adding users beyond the founding team.

Emails and one-time codes

Two emails are sent: one when an administrator adds a user, and one when a person clicks New user / Forgot password on the sign-in dialog. Both are HTML templates that can be edited. The second carries a one-time code, valid for a set number of minutes and usable once; the person enters the code and chooses a password. The added-user email carries no code. A code requested for an address the account does not know produces a notification rather than an email.

Sign-in methods

Every account has password sign-in, and can add single sign-on beside it. Password sign-in can be turned off only once single sign-on is configured, so that an account always keeps a way to sign in.

Password sign-in settings

Session cookie

Password policy

Emails