Configure Email & Password Sign-In
Email and password sign-in lets users authenticate with credentials created for this deployment. Configure the existing Email & Password provider in the Providers tab, listed as Database Identity Provider until you rename it. A new deployment starts with it enabled, while existing deployments retain their configured sign-in methods. While it is enabled, the sign-in page shows the email and password form, self-service password reset is available, and administrators can invite new users by email.
Permissions
Only users with the Admin role can manage sign-in providers. See the Permissions page for details.
Note
Only one Email & Password provider can exist, so while one is enabled the Email & Password option in the Add Provider modal is greyed out and cannot be selected. You adjust the existing provider instead of adding a new one.
Field reference
The Edit Provider modal shows the sections below for the Email & Password provider.
General
Identifies the provider to administrators.
| Field | Required | Type | Description |
|---|---|---|---|
| Display Name | Text | The name that identifies this provider in the Providers tab. Unlike the identity provider types, it is not shown on the sign-in page, which presents the email and password form instead of a named button. |
Password Policy
What a password has to contain before Qualytics accepts it.
| Field | Required | Type | Description |
|---|---|---|---|
| Minimum Password Length | Slider | Minimum number of characters, from 12 to 128. Defaults to 12. The current value is shown beside the field. |
|
| Lowercase letter | Checkbox | Require at least one lowercase letter. On by default. | |
| Uppercase letter | Checkbox | Require at least one uppercase letter. On by default. | |
| Number | Checkbox | Require at least one number. On by default. | |
| Special character | Checkbox | Require at least one special character (for example !, @, #, $). On by default. |
|
| Example of valid password | Text | Read-only. A sample password that satisfies the current policy, updated as you adjust the settings above. |
Passwords are also checked against a list of commonly used passwords, regardless of the policy settings. Deployments with outbound internet access can additionally have passwords checked against known-breached password lists.
Account Security
How failed sign-ins are handled, and how long each kind of credential stays valid.
| Field | Required | Type | Description |
|---|---|---|---|
| Account Lockout Threshold | Slider | Failed sign-in attempts before the account is temporarily locked, from 3 to 20. Defaults to 5. |
|
| Lockout Duration | Number | How long a locked account stays locked, in minutes, between 5 and 1440. Defaults to 15. |
|
| Password Reset Expiry | Number | How long a password reset link stays valid, in minutes, between 5 and 1440. Defaults to 60. |
|
| Invitation Expiry | Number | How long an invitation link stays valid, in hours, between 1 and 168. Defaults to 72. |
|
| Session Duration | Number | How long a Qualytics session stays valid after sign-in, in minutes, between 5 and 1440. Defaults to 480, which is 8 hours. |
Each of the four minute and hour fields shows its accepted range under the input, and values outside it are refused when you save. The two sliders cannot leave their range at all.
Steps
Step 1: Open Settings from the left sidebar, click the Access tab, and open the Providers tab.
Step 2: Click the vertical ellipsis next to the provider whose type is Email & Password.
Step 3: A menu appears with the available actions. Click Edit .
Step 4: The Edit Provider modal appears. Adjust the fields as needed (see Field reference above).
Step 5: Click the Save button.
Step 6: A success message appears.
Note
If password sign-in is disabled, enable the provider from its row in the Providers list to offer it alongside your SSO providers. See Manage Providers.
What Users Experience
- The sign-in page shows Email and Password fields alongside the buttons of your other enabled providers.
- The Reset Password link on the sign-in page lets users request a reset link by email. The confirmation message is the same whether or not the email has an account, and the link expires after the configured reset expiry.
- After too many failed attempts, the account is locked for the configured duration and the sign-in page says when to try again.