Aptli

Authentication

Authentication verifies a user is able to access your application, but doesn't define what they can see or alter. (./authorization)

Authentication verifies your identity before you can access Aptli. You log in with your email and password, and the system maintains a secure session.

Customizing Admin Settings

Modification of any of these settings will require the appSettingSchemasModify admin right on the user profile. This is granted by default to super admins upon access to the application, but may be shared by other admins. To see the admin rights a user has view their profile under users (http://your host/admin/users) and see Admin Rights.

Checking Admin Rights

The following may be customized to overide the (defaults):

  • Allow Registration - Allow users in the allowed domains to create unregistered accounts and automatically receive emails to register them without having an admin approve the request. (Default: false)
  • Max Login Attempts - Number of failed login attempts before an account is set to "hard lock." Once an account is hard locked it will need to be unlocked by someone with usersUpdate admin rights. (Allowed range: 1–20. Default: 5 tries)
  • Lockout Time: How long, in seconds, a failed-attempt counts toward the lock. Failures older than this drop out of the count, so the lock self-clears after a quiet period. (Allowed range: 300–3600 seconds.)
  • Two-Factor Authentication: A single on/off setting (requireTwoFactorAuth) that requires SMS 2FA for every login. There is no grace period.

Allowed Domains is not a setting on this page. The email allowed-domains list is environment-only (NUXT_ALLOWED_DOMAINS) and is managed from the support portal's My Environment page, so invite validation, mail delivery, and CSRF origin can't drift across DB-vs-env sources.

Active Login Methods are not toggled here either. Which methods appear (Username/Password plus any of Google, GitHub, Microsoft, Keycloak) is derived from which OAuth client IDs are present in the environment (NUXT_OAUTH_*_CLIENTID). Username/password is always available; configuration of the SSO alternatives should be handled with Aptli's devs ([email protected]).

Session, CSRF, and session-expiry timeouts have moved to the provisioning portal and are shown read-only on the settings page; they are no longer edited here.

Force Logout

  • From the admin pages /admin/users a user can be hard locked and logged out from the actions menu against each user: User Actions

Troubleshooting Login:

If a user is having trouble logging in start by viewing the profile in the admin > users link or go to /admin/users. Login problems are likely because of one a few possibilities:

  • Deleted Account. If you can't find the user account either by scrolling or filtering by case-sensitive email in the upper left, they may have been deleted. If you have the "viewDeleted" access on your profile, you should see a button in the upper right See Deleted. Clicking this and refreshing will show deleted accounts. If you have usersCreate admin right, you can undelete the account through the actions button on their profile.
  • Hard Lock. Users can be hard locked if they've entered the wrong password too many times or this can also be manually set to prevent them from further access. Look for Hard Lock If you have usersUpdate admin right you can unlock their profile.
  • The user's email has not been validated. In the user's validated email field there should be a date when the user has verified completed their validation process. A link with a 10-minute token is sent to the user to activate their account. If it's not completed they can't login through any method, including SSO.
  • Bad domain. Noted above in the application settings users cannot be added if they're from an unrecognized domain. Slight changes may occur over time if the domain name changes, but "external" addresses may be added manually by an admin with usersCreate through the menu in the upper right.

If you make changes to an account, you'll need to submit them through the upload changes button shown as a cloud with an arrow pointing up. Changes to user profiles take effect immediately. See Deleted

Further questions can always be answered through your contact through [email protected]