Security

Phase 1 preview — pages render fixture data only; no changes are saved.

What lives where. The fields below are stored in the settings table. Session lifetime, secure cookies and sign-in throttling are environment-only and listed read-only underneath.

Two-factor authentication

Turning this on forces enrolment of an authenticator device immediately, for everyone it applies to. The app does not check a live code on every API call, only that the user has enrolled.

Two-factor authentication

Optional lets people opt in on their profile. Required makes everyone enrol an authenticator device at their next sign-in.

Password policy

Applies when a password is set or changed. There is no password expiry, history or reuse prevention.

Minimum password length

Minimum permitted value is 8.

Prevent common passwords

Rejects passwords found in a list of commonly used ones.

Complexity rules

Password cannot match the user's name, username or email

Must contain letters

Must contain numbers

Must contain symbols

Must mix upper and lower case

Remote user login

Legacy-only. Trusts a header set by the web server and signs that user in without a password. If anyone can set the header, anyone can sign in as any user, including a superuser.

Enable remote user login

Matches the header value to an active user by exact username. Nobody is created automatically.

Header name

Leave blank for REMOTE_USER. Use the server variable name, for example HTTP_X_REMOTE_USER.

Custom logout URL

Where people go after signing out while remote-user login is on.

Disable the local sign-in form

Only available once remote-user login has been enabled and saved. With it on, the local login page returns 403.

Cancel Saving settings is not available in Phase 1 — this screen previews the current configuration.

Controlled by the environment (read-only)

These behaviours have no settings screen in the legacy app. Change them in the server environment.

Behaviour	Environment variable	Effective value
Session lifetime	SESSION_LIFETIME	12000 minutes
Expire session on browser close	EXPIRE_ON_CLOSE	No
Secure cookies	SECURE_COOKIES	On (HTTPS only)
Failed sign-ins before lockout	LOGIN_MAX_ATTEMPTS	5
Lockout duration	LOGIN_LOCKOUT_DURATION	60 seconds
Two-factor codes per minute	TWO_FACTOR_MAX_ATTEMPTS_PER_MIN	5
Password reset link validity	RESET_PASSWORD_LINK_EXPIRES	900 seconds
Password re-confirmation window	PASSWORD_CONFIRM_TIMEOUT	10800 seconds
Force SAML sign-in	REQUIRE_SAML	No
Demo lock	APP_LOCKED	Off

OIDC bearer validation

Disabled

Configured in the environment, not here: legacy has no settings screen for it, and none is invented. It only validates bearer tokens presented to the API; it is not an interactive sign-in.

Environment variable	Purpose	Actions
OIDC_API_ENABLED	Master switch (default off).
OIDC_API_ISSUERS	Comma-separated list of accepted token issuers (iss).
OIDC_API_AUDIENCE	Comma-separated list of accepted audiences (aud).
OIDC_API_JWKS_URI	Optional. Otherwise discovered from each issuer's .well-known/openid-configuration.
OIDC_API_ALGORITHMS	Accepted signing algorithms (default RS256, RS384, RS512, ES256; HS* and none are never accepted).
OIDC_API_USERNAME_CLAIM	Claim matched to a local username (default preferred_username).
OIDC_API_LEEWAY	Clock skew allowance in seconds (default 60).

Only the state is shown, never a value. A token's username claim is matched to an existing, active local user; nothing is provisioned, and that user's normal permissions apply.

Not part of the legacy application

Password expiry and history, a configurable lockout threshold stored in the database, remember-me settings, and per-account lockout do not exist, so none is offered here. Sign-ins are throttled per username and address using the environment values above.