Users

This section describes how user accounts are created and signed in to, what each role may do, and how an administrator manages users, companies, IP access lists, the license and the audit log. This page covers signing in, session handling and failed sign-in attempts.

Signing in

Access to the system is granted through the sign-in page.

• While no corporate identity provider is enabled, the page contains the Email and Password fields and the Sign in button. Your registered email address is your user name
• When corporate identity providers are enabled, signing in is split into steps: the address comes first, then a corporate provider or the DataForge password. This is described on the page about signing in with a corporate account in this section
• The Forgot password? link starts password recovery. When signing in is split into steps, the link is on the step with the DataForge password
• Pressing Enter works the same as clicking the primary button of the screen while that button is available
• After a successful sign-in you are taken to the list of projects available to you
• The interface language of the sign-in page follows the language last selected in the application

Before the session is opened, the system performs the following checks in order: the account must exist, it must not be deactivated, the password must match, and the client IP address must be allowed by the company's IP access lists.

Session rules

• The application renews the session in the background, so you are not asked for your password again while the session is valid
• Only the most recent sign-in keeps a renewable session. When you sign in on another device or in another browser, the session on the previous one can no longer be renewed
• The maximum session lifetime is defined by the deployment configuration. By default a session can be renewed for 7 days from the moment of signing in; after that a new sign-in is required
• Logout in the user menu ends the session immediately. The session cannot be renewed after signing out, and both authentication tokens are removed from the browser

Failed sign-in attempts

The sign-in page reports a failed attempt with a single generic message, so it is not possible to tell from the response which of the two credentials was wrong.

Situation	Message
Wrong email or password	"Incorrect email or password"
More than 5 sign-in requests within 60 seconds from one address	"Too many attempts. Please try again later"
The account was deactivated by an administrator	"User is disabled. Contact the administrator to restore access"
The client IP address is not allowed	"Access denied for your IP address. Contact administrator for details"

Every successful and every failed sign-in is recorded in the audit log together with the client IP address.

Account lockout

Repeated wrong passwords lock the account. The system counts failed attempts in a sliding window of 5 minutes; when the fourth attempt in that window is reached, the account is locked and the user receives a lockout email.

The lockout duration grows with each consecutive lockout:

Lockout	Duration	How it is lifted
First	5 minutes	Automatically when the period expires
Second	15 minutes	Automatically when the period expires
Third	1 hour	Automatically when the period expires
Fourth	24 hours	Automatically when the period expires
Fifth and later	Permanent	Only by an administrator or by resetting the password

An administrator can also lock an account manually, and can set the lockout duration when doing so.

Messages shown to a locked user on the sign-in page:

Cause of the lockout	Message
Failed sign-in attempts, temporary lockout	"User is locked due to multiple failed login attempts. Wait until unlocked at {time} or try resetting your password to restore access"
Lockout by an administrator, temporary	"User has been locked by an administrator. Wait until unlocked at {time} or try resetting your password to restore access"
Failed sign-in attempts, permanent lockout	"User is permanently locked due to multiple failed login attempts. Contact administrator or try resetting your password to restore access"
Lockout by an administrator, permanent	"User has been locked by an administrator. Contact the administrator or try resetting your password to restore access"

Notes:

• {time} is the remaining lockout time in HH:MM:SS format
• All four messages carry a Restore access button that opens the password recovery dialog. Setting a new password lifts the lockout, including a permanent one
• The lockout is also lifted automatically as soon as its period expires; the next sign-in then succeeds with the correct password
• Password recovery is described on a separate page of this section