Password, session length and IP addresses

This article explains how to set your workspace’s password rules, limit sign-in attempts, set the session length and restrict access to Illizeo by IP address. It is for administrators. The rules set here apply to every user of the workspace: employees, managers and administrators.

Before you start #

• Permissions are set in Settings › Manage Employees › Employee Roles, in the “Platform administration” menu of the role matrix (see Permissions & roles).
• Password rules and attempts: the “Password configuration” permission (Authentication section). The Access level lets you read the page, the Execute level lets you change it.
• Session length: the “Platform settings” permission (Global settings section), at the Execute level to change it.
• Allowed and blocked IP addresses: the “Whitelisted IPs” permission (Security & access section), at the Execute level, including to view the two lists.
• By default, only the Administrator role holds these permissions.

Password rules #

1. Open Settings › Manage Illizeo › Authentication. The Password Configurations page opens in read mode.
2. Click the edit icon at the top right of the card. It only appears with the Execute level.
3. Set the rules (see below), then click Save, or Cancel to go back to the saved values.

The available rules:

• Minimum length and Maximum length: the minimum cannot exceed the maximum. With no minimum (value 0), Illizeo requires at least 8 characters.
• Mixed case required: at least one lower-case and one upper-case letter.
• Alpha characters required: at least one letter.
• Non-alpha characters required: at least one character other than a letter: a digit or a symbol.
• Numeric characters required: at least one digit.
• Special characters required: at least one symbol.
• Under “Password cannot contain any of the following user information :”, the First Name, Last Name and Username switches reject a password containing that information, whatever the case.

These rules apply whenever a password is chosen: when accepting an invitation, changing one’s own password, resetting it by email, and when an administrator sets an employee’s password. Illizeo also rejects a password found in a known data breach. The rules are not checked again at sign-in: an existing password keeps working until it is next changed.

Sign-in attempts #

Under Login Authentication :, on the same page:

• Maximum number of login attempts: from 1 to 20, 5 by default.
• Waiting time between 2 failed connections: from 1 to 10 minutes, shown in hours and minutes, 5 minutes by default.

The counter covers one email address from one IP address. After each failure, the sign-in screen shows how many attempts are left. Once the maximum is reached, sign-in for that account from that IP address is blocked for the set time, and the screen shows a countdown. A successful sign-in resets the counter. An unknown email address is counted in the same way: the screen never reveals whether an account exists.

Forgotten password #

• Enable Forget Password feature on: the Forgot? link on the sign-in screen sends a reset link, valid for 30 minutes.
• Switch off: the link is still shown, but no email is sent. The screen gives the same answer in every case, so that nothing is revealed about existing accounts.
• Whatever this switch, the Get a sign-in link by email button sends a link that signs the person in without a password, single-use and valid for 15 minutes. It disappears when single sign-on is required.
• An administrator can also help an employee from their profile: ⋮ menu, Manage account, Reset Employee Password block, with Send Reset Email (“Send a password reset email” permission) or Define Password (“Set an employee’s password directly (bypassing the email flow)” permission), at the Execute level.

Session length #

1. Open Settings › Manage Illizeo › Global Settings › Manage Platform Settings.
2. In the Communication & Redirections card, enter the Session duration in minutes: from 5 to 480, or 0 to turn off automatic logout. The default is 60 minutes.
3. Save the page.

The session length is an inactivity period: as long as the person is working, their session is extended. Ten minutes before the end (or halfway through a short session), the “Are you still there?” window offers Continue my session or Log out. Without an answer, the session closes and unsaved work is lost. The rule applies to every way of signing in: password, email link and single sign-on.

Allowed IP addresses #

As long as no active address is in the list, access is not restricted. As soon as one address is active, Illizeo only accepts connections from the addresses and ranges in the list: at sign-in, then on every action, for every user, in the browser as in the mobile app.

1. Open Settings › Manage Illizeo › Whitelisted IPs. The Whitelisted IP Addresses page shows your current address.
2. If the “Your IP address is not whitelisted” banner appears, first click Whitelist my IP. As long as your own address is not in the list, Illizeo refuses to add any other: otherwise you would lock yourself out.
3. In Add an IP address, enter an IPv4 or IPv6 address, or a CIDR range (for example 192.168.1.0/24), and an optional label. Click + Add.
4. On each line, the switch enables or disables the address, and the bin deletes it after you confirm with Delete.

The line covering your address carries the YOUR IP badge: you can neither disable nor delete it. The Registered IPs, Active and Inactive counters, and the search by address or label, complete the page.

Blocked IP addresses #

The block list does the opposite: an active blocked address is refused on every action, even if it is also in the allowed addresses. An empty list blocks nothing.

1. Open Settings › Manage Illizeo › Blocked IPs.
2. In Block an IP address, enter an address or a CIDR range and an optional label, then click Block.
3. The switch on a line suspends or restores the block. The bin (Unblock) removes the entry after you confirm with Delete.

Illizeo refuses to block, or to re-enable, an entry covering your own address, CIDR ranges included. Suspending or removing a block is always possible.

Good to know #

• The address that counts is the one Illizeo receives: behind a company VPN or proxy, it is the public exit address. A person working from home or on a mobile network changes address: plan the matching ranges before turning on the allow list.
• The address lists apply to sessions already open, from the next action.
• A password is always case-sensitive.
• Successful and failed sign-ins are logged: see Governance & security.

FAQ #

An employee has no attempts left. #

They must wait until the countdown ends, or sign in from another network. They can also ask for a sign-in link by email.

After a network change, nobody can get in. #

An administrator still signed in from an allowed address can add the new address. Otherwise, contact Illizeo support.

Should the mobile app’s addresses be listed? #

Yes: the allow list also applies to the mobile app. A phone on a mobile network has an address that changes often; it will only be able to sign in from an allowed network, such as the company Wi-Fi.