Security settings
Password policy
Section titled “Password policy”Orbit enforces a password policy. It applies to registration, invitations, administrator-created accounts, password changes and resets.
| Rule | Value |
|---|---|
| Minimum length | By default at least 10 characters |
| Every other rule: maximum length (up to 64), upper and lower case, digits, symbols, not the e-mail name | Set by your company’s administrators for your own organization. Planned |
The administrator setting for these other rules is not available to company administrators yet. Existing passwords keep working when the policy changes. Site administrators can read the rules. The account page’s password form follows the policy.
Sessions and devices
Section titled “Sessions and devices”Each person sees their signed-in devices, with device, address, when it started and when it was last seen, and can end one session or all the others. Changing or resetting a password signs out every other device.
Signing another person out of every device is not available to site administrators yet and is Planned. If someone loses a device, ask them to change their password: it signs out every other device. Service accounts have no sessions.
Password reset
Section titled “Password reset”A reset link is mailed once, is valid for one hour, works once, and is stored hashed. At most five reset links an hour are sent per account. The answer to a reset request is the same whether or not the address has an account. Confirming a reset ends every session of the account.
Sign-in throttling
Section titled “Sign-in throttling”Wrong password, unknown address and disabled account all answer alike. After 10 failed sign-ins for one address within 15 minutes, from any client or company site, further attempts get a 429 until the window ends. A successful sign-in clears the count.
Audit of sign-ins
Section titled “Audit of sign-ins”Sign-ins, accounts, sessions, roles and invitations are written to the append-only audit log in the same transaction as the change. See Audit log.
Status
Section titled “Status”| Capability | Status |
|---|---|
| Password sign-in, password policy, sessions and devices, reset | Built |
| Password rules set by your company’s administrators, signing a person out everywhere | Planned |
| SAML 2.0 and OIDC single sign-on | In development See Single sign-on |
| SCIM provisioning | In development See SCIM |
| Enforced SSO per organization | In development |
| Multi-factor authentication | Planned |
| Sign in with Google and Microsoft | Planned |