Signing in and sessions

The normal route is passwordless: you give an email address and receive a one-time link. In the cloud that is the only route; the Enterprise installation additionally knows a password.

Magic link — cloud and Enterprise

Property	Value
Validity	15 minutes
Usability	exactly once — redemption is a single, atomic database operation
Storage	only the SHA-256 hash of the token, never the token itself
Throttle	5 open requests per email address and hour
Session	a cookie, 30 days sliding — every use extends it

Two peculiarities that regularly prompt questions

The link leads to a confirmation page, not straight into the account. Link scanners in mail systems call every link in an incoming message and would have consumed the one-time token before the recipient ever saw it.

Signing in never reveals whether an address has an account. Signing in and registering are the same sequence, and a throttled request looks to the caller like a successful one. The user and their personal tenant are created only when the link is redeemed.

If no mail arrives

If no SMTP server is configured, the page states neutrally that dispatch is currently not possible. In an installation without a mail route that is the normal case — there the password route gets you in.

Password — Enterprise installation only

In the cloud no account has a password; the sign-in form offers none there either. In an installation on your own premises the password is the main route, because a fresh installation without a mail relay would otherwise be unreachable.

Property	Value
Method	PBKDF2-HMAC-SHA256, 210,000 iterations, 16-byte salt, 32-byte output
Minimum length	12 characters — length only, no composition rules (following NIST SP 800-63B)
Lockout	after 10 consecutive failed attempts for 15 minutes

Why no composition rules

Requirements such as “at least one special character” measurably produce predictable patterns — Password1! satisfies them. Length is the more effective lever; NIST SP 800-63B recommends the same.

An administrator can set a password on the command line and force a change at the next sign-in. See Administration on the command line.

What happens when rights are withdrawn

Membership is read afresh on every request — a withdrawn right applies immediately, even while the 30-day session is still valid. See Members and roles.