User Authentication¶

System-wide login, password, and two-factor policy. These settings apply to every local QIE account; per-account settings live on Users and Roles.

Invalid Attempts¶

This option controls how many invalid login attempts a user account can accumulate before it is locked. Once locked, the user can unlock the account by using Forgot password on the login screen (which emails a one-use password that bypasses the lock), or a system administrator can unlock it from Users and Roles.

Default: 5. Set to 0 to disable account lockout entirely.

When enabled, administrators are emailed as soon as a user account reaches the specified number of consecutive invalid login attempts. This runs independently of the Invalid Attempts lock threshold. The email can fire before the account is locked, letting administrators see repeated failures during the retry window.

The check box next to the field turns the notification on or off; the number field is the threshold. Default: 3 attempts.

Forgot Password¶

Users can recover a forgotten password from the login screen. Click Forgot password, enter the username, and QIE emails a temporary single-use password to the address on that user's account. The single-use password is valid for 15 minutes and unlocks the account if it was locked by Invalid Attempts, because the single-use path bypasses the lockout check.

Prerequisites: SMTP must be configured on the Email Settings page, and the user must have a valid email address on their account.

Forgot Password is available for local users only. Domain (LDAP) and OIDC users must reset their passwords through the identity provider.

Lock Timeout¶

This option controls how long the workstation is idle before it is locked. This timeout only applies to sessions where the client has had no activity (mouse clicks/key strokes, etc.) for extended periods of time.

Logout Timeout¶

This option controls how long a workstation is idle before the user is automatically logged out. This timeout only applies to sessions where the client has had no activity (mouse clicks/key strokes, etc.) for extended periods of time.

User Password Settings¶

The user password settings control the global level of QIE security policies. The global settings configured here can be overridden on a user-by-user basis from the Manage Users page.

Days Valid¶

This setting determines the frequency with which users must change their passwords. If this field is set to zero (0) users are never prompted to change their password.

Strength¶

This setting controls the minimum password strength required when setting or changing a password.

None: No password strength requirements enforced.
Weak: Passwords require at least 3 characters.
Medium: Passwords require at least 6 characters and must contain at least one letter and at least one number or symbol.
Strong: Passwords require at least 8 characters and must contain:
- both uppercase and lowercase letters
- at least one number
- at least one symbol

Two-Factor Authentication¶

The two-factor authentication settings control whether users can opt in to a second authentication factor at login, and whether trusted devices can skip the second factor for a configurable period.

Enable two-factor authentication¶

When this option is enabled, each user can choose to require two-factor authentication for their own account. The first factor is the user's username and password; the second factor is a one-time passcode sent to the user's verified email address. Users opt in from Application -> Edit My Profile on the User Profile dialog.

Note

Email Settings must be configured before two-factor authentication can be enabled. Users must also verify their email address on the User Profile dialog (using the same passcode process) before they can enable two-factor authentication for themselves. Verification takes effect as soon as the passcode is accepted: closing the User Profile dialog with Cancel does not undo it.

Enable 'remember device' for N days¶

When enabled, a user can choose to have QIE remember the device they are signing in from for the specified number of days after successfully completing the two-factor challenge. A remembered device is identified by a secure cookie stored in the user's browser, and is not re-challenged for two-factor authentication on subsequent logins until the cookie expires.

The duration accepts 0 to 365 days, where 0 means the remembered device never expires.

This option is only selectable when Enable two-factor authentication is enabled. A remembered device can be forced to be unremembered before the cookie has expired by any of the following:

The user deletes the cookie from their browser.
An administrator disables 'remember device'.
The user's password is changed.