Accounts, roles and sign-in
A built-in role controls the access of each account. This page explains sign-in methods, password rules, sessions and recovery.
- Available
- Local and directory accounts, password rules, lockout and sessions
- Available
- Four built-in roles
- Off by default
- Single sign-on (OIDC, SAML)
On this page
Each person signs in with a local account or with directory credentials. A built-in role sets what each account can do.
Sign in
- Local accounts. An administrator invites each person. An invitation link is valid for 7 days and works one time.
- Directory accounts. When the directory source is configured, people can sign in with LDAP directory credentials. See API connectors and ticketing.
- First account. Devexana creates the first administrator account during installation and gives it to your named contact. See How Devexana is delivered.
- Password reset. An administrator issues a reset link. A reset link is valid for 24 hours and works one time.
Passwords and sessions
Passwords must contain at least 12 characters. The appliance rejects common passwords. The appliance stores passwords and session tokens only as hashes.
| Setting | Default | Can be changed |
|---|---|---|
| Minimum password length | 12 characters, with a list of refused common passwords | No |
| Password storage | scrypt hash | No |
| Session length | 12 hours, or 14 days when the person selects "remember me" | No |
| Idle sign-out | Off | Yes |
Lockout
By default, five failed sign-in attempts in 15 minutes lock the account for 15 minutes. Administrators can change this policy. The appliance also limits sign-in attempts for each network address.
The appliance records each failed sign-in and each lockout in the audit log.
System-use notice
Each user accepts the system-use notice before Devexana shows any data.
Roles
Four built-in roles control access: Full access, Standard, Auditor and No access. An administrator assigns a role to each person in Settings › Account, under Teammates.
| Role | What the role can do |
|---|---|
| Full access | All available functions, including account, settings, source and audit management |
| Standard | Sign in, ask questions, search and read data. Approve Routine results that are sent to business systems (Routines (scheduled reports)) |
| Auditor | Sign in, view, verify and export the audit log and the egress log. No access to other data |
| No access | No access to data or settings |
Network-device configuration changes are disabled in code in this release. The change-approval design is on Change proposals and human approval.
The appliance records each role change in the audit log.
Separation of duties
The Full access role includes account management and audit management. Assign the Auditor role to the person who reviews the audit log. This assignment does not remove audit management permissions from Full access accounts.
Multi-factor sign-in
Single sign-on
Single sign-on with OIDC and SAML is available and off by default.
Account recovery
An administrator issues a reset link to a person who cannot sign in. If no administrator can sign in, recovery requires physical access or console access to the appliance.
Not in this release
This release does not include the mobile companion. People sign in through the web interface only.
Applies to Devexana release 0.3.182. Page updated 2026-10-20. Questions or corrections: support@devexana.com.