Every installation starts with the default values described on this page.
Password requirements
Sets the minimum length and the kinds of characters every new password must contain. This policy is always active and cannot be switched off.
The requirements are checked whenever a password is set: when someone changes their own password, resets a forgotten one, or when you create a user or set a temporary password. They are not checked at sign-in, so tightening them never locks anybody out. People keep signing in with their current password until they change it.
When a password is refused, the message names every requirement it misses. The password suggested when you create a user or set a temporary password always meets the requirements, and is longer if you raise the minimum length.
Session lifetime
Controls how long a sign-in stays valid. This policy is always active and cannot be switched off.
Both timers run at the same time, and whichever is reached first ends the session. With the defaults, someone who steps away for a full working day has to sign in again, and someone who works daily has to sign in again after a month.
Changes apply to people signing in from now on. Anyone already signed in keeps the limits that were set when they signed in.
Choosing values
1
Open Settings → Security → Policies
Click the Session lifetime row to open its settings.
2
Set the inactivity timeout
Shorter is safer, but people will be asked to sign in more often. 8 hours covers a working day. 30 minutes suits shared or public computers.
3
Set the maximum lifetime
This is the hard limit. Even someone using Collabase every day has to sign in again once it is reached.
4
Save
Click Save. The new values apply to the next sign-in.
Your active devices
Everyone can see where their own account is signed in, under Settings → Profile → Security. The list shows the browser and operating system, the last time each device was used, and marks the one you are using now. Click Sign out next to a device to end that session, or Sign out all other devices to end every session except the current one. The device is signed out the next time it makes a request. Use this after signing in on a computer that is not yours, or if you suspect somebody else has access to your account.Brute-force protection
Locks an account after repeated failed sign-in attempts, so a stolen email address cannot be paired with guessed passwords.
Locked accounts are listed under Settings → Security → Brute Force Protection, where you can release one early.
Locked accounts
Sets how long a locked account is kept before it is anonymized. This policy is always active and cannot be switched off. It applies to accounts that an administrator locked and to accounts that your identity provider deactivated through SCIM or LDAP.
Locking ends all sessions at once. Anonymization then removes the name, email address, sign-in methods and devices for good. Pages, work items and comments stay and show the name followed by
(deleted).
A changed period applies to accounts locked from then on. Accounts that are already locked keep their date. Releasing an account before its date cancels the anonymization.
SSO bypass
When single sign-on is enforced, everybody is sent to the identity provider. This policy lets named people and groups sign in with an email address and password instead. Keep at least one administrator on this list. If the identity provider becomes unreachable and nobody can bypass it, nobody can sign in.1
Turn the policy on
Click the switch in the SSO bypass row.
2
Add the people who need it
Search for users and groups, and select them. Administrators responsible for recovery belong here.
3
Generate the bypass link
Click Generate token, then copy the link and share it with the people you selected. Opening it shows the password sign-in form.
4
Save
Click Save.
Next steps
Users and groups
Invite users, assign roles, organize teams into groups, and set up automated provisioning with SCIM.