Password and access control

Project managers and organization managers can control a user’s password and access from the user’s page. These options are available for users who sign in with a Cellosign password, not for users who sign in through SSO, and you can’t use them on your own account.

Password control

Option	What it does
Send Temporary Password	Creates a temporary password and emails it to the user. The user must change it at the next login. The user must have an email address. If the email can’t be delivered, the password is not changed; check the project’s email integration.
Force reset password	The user must change the password at the next login.

Account status

Option	What it does
Block user	Blocks the user from signing in to Cellosign.
Unblock user	Unblocks the user. The user signs in with their current password and must then choose a new one. A user who was locked after too many failed login attempts is unblocked in the same way.

There is no option to delete a user. To stop a user’s access, block the user.

In projects where SSO is enforced, Send Temporary Password, Force reset password and Unblock user are not available, because users sign in through the identity provider. Block user is still available.

Lockout after failed login attempts

The account lock is configured per project, in the project’s Security settings under Account lock settings. See Project security.

Setting	What it does
Policy	Lock: the account stays locked until a manager unblocks it. Temporary lock: the account is unlocked automatically after the lock time.
Lock account after failed login attempts	The number of failed attempts before the account is locked: 3–10. The default is 5.
Account will be locked for [minutes]	For Temporary lock: 2–60 minutes. The default is 5.

For a user with roles in several projects, the strictest settings apply: the lowest number of attempts, the longest lock time, and Lock if any of the projects uses it.

Password rules

Password rules are also set per project, in the project’s Security settings:

• Password strength settings: Password minimum length (at least 8), Require at least one capital letter, Require at least one digit and Require at least one special character.
• Password renewals: when Enabled, users must change their password after the set Interval. When fewer than 7 days are left, the user’s page shows how many days remain.

For a user with roles in several projects, the strictest rules apply: the longest minimum length, every requirement that any of the projects turns on, and the shortest renewal interval. For example, if project A requires 8 characters and project B 10 characters, the user’s password must have at least 10 characters.

In addition, Cellosign always rejects common passwords, passwords too similar to the user’s details, and reusing the current password.

Forgot password

On the login page, users can click Forgot password and enter their user name or email address. Cellosign sends a password reset link by email. For security, the response is always “Instructions for recovery posted to your email”, whether or not the user exists.

• Each reset link can be used only once. To try again, request a new link.
• Users can request a link once every 5 minutes, and up to 5 times a day.
• Reset emails are not sent to service users or to users who sign in through SSO.