Skip to main content

Authentication

Authentication is how users prove who they are when logging in. Console supports multiple authentication methods to balance security and convenience.

Authentication Methods​

Console offers several ways for users to log in:

🔑 Email & Password

Traditional login with a secure password

📧 Passwordless Login

Receive a temporary code via email

🔐 Single Sign-On (SSO)

Enterprise authentication via OIDC or SAML

🔒 Google OAuth

One-click login with Google accounts

Email and Password​

The traditional authentication method where users log in with their email address and a password.

Password Requirements​

For security, passwords must meet these requirements:

  • Minimum 12 characters long
  • At least one uppercase letter
  • At least one lowercase letter
  • At least one number
  • At least one special character (!@#$%^&*, etc.)

Password Management​

Forgot Password:

  1. User clicks "Forgot Password" on login page
  2. Enters their email address
  3. Receives reset link via email
  4. Creates new password

Admin Reset: Administrators can send password reset emails:

  1. Go to Users
  2. Select the user
  3. Click Send Password Reset
  4. User receives reset email
Security Best Practice

Encourage users to use unique, strong passwords and consider requiring a password manager.

Passwordless Login​

A modern alternative that eliminates passwords entirely.

How It Works​

  1. User enters their email address
  2. Receives a 6-digit code via email
  3. Enters the code to log in
  4. Session is created (no password needed)

Benefits​

  • No password to remember - Reduces support requests
  • No weak passwords - Eliminates common password problems
  • No password reuse - Can't reuse passwords across sites
  • Temporary codes - Codes expire quickly

Enabling Passwordless​

As an administrator:

  1. Go to Settings → Authentication
  2. Enable Passwordless Login
  3. Users will see this option on the login page

Single Sign-On (SSO)​

Enterprise-grade authentication using your existing Identity Provider (IdP).

Supported Protocols​

Console supports both modern and legacy SSO standards:

ProtocolWhen to UseCommon Providers
OIDC (OpenID Connect)Modern standardOkta, Auth0, Azure AD, Google
SAML 2.0Legacy systemsActive Directory, Shibboleth

Benefits of SSO​

Centralized Access

One login for all company applications

Compliance

Meet enterprise security requirements

Automatic Provisioning

Users created automatically on first login

Simplified Offboarding

Deactivate once in IdP, removes all access

Configuring SSO​

To set up SSO for your organization:

  1. Go to Settings → Single Sign-On
  2. Choose your protocol (OIDC or SAML)
  3. Enter your IdP details:
    • OIDC: Client ID, Client Secret, Issuer URL
    • SAML: Metadata URL or upload XML file
  4. Map user attributes (email, name, etc.)
  5. Test the configuration
  6. Enable for your organization

See the Configuring SSO Guide for detailed instructions.

SSO Enforcement​

You can require all users to use SSO:

  1. Go to Settings → Single Sign-On
  2. Enable Require SSO for all users
  3. Other login methods are disabled
  4. Users must authenticate via your IdP
Just-In-Time Provisioning

Enable JIT provisioning to automatically create users when they first log in via SSO. No need to manually invite them!

Google OAuth​

Quick and easy authentication for users with Google accounts.

How It Works​

  1. User clicks Sign in with Google
  2. Redirected to Google authentication
  3. Approves access
  4. Logged into Console

Enabling Google OAuth​

  1. Go to Settings → Authentication
  2. Enable Google OAuth
  3. Users see "Sign in with Google" button

When to Use​

Google OAuth is great for:

  • Small teams using Google Workspace
  • Quick onboarding without setting up SSO
  • Organizations without an enterprise IdP

Two-Factor Authentication (2FA)​

Add an extra layer of security by requiring a second factor beyond the password.

How 2FA Works​

Login Flow with 2FA:
1. Enter email and password → Success
2. Enter 6-digit code from authenticator app → Success
3. Logged in

Setting Up 2FA​

For Users:

  1. Go to Profile → Security
  2. Click Enable Two-Factor Authentication
  3. Scan the QR code with an authenticator app:
    • Google Authenticator
    • Microsoft Authenticator
    • 1Password
    • Authy
  4. Enter the 6-digit code to confirm
  5. Save backup codes in a safe place

For Administrators:

  1. Go to Settings → Security
  2. Enable Require 2FA for all users
  3. Existing users will be prompted to set up 2FA on next login

Backup Codes​

When setting up 2FA, users receive backup codes (single-use recovery codes):

  • Store them securely (password manager, safe place)
  • Use them if you lose access to your authenticator app
  • Each code can only be used once
  • Generate new codes if you use all of them

Resetting 2FA​

If a user loses access to their authenticator:

As Administrator:

  1. Go to Users → Select the user
  2. Click Reset 2FA
  3. User must set up 2FA again on next login
Security Notice

Only reset 2FA after verifying the user's identity through another channel (phone, video call, etc.)

Login Process​

Basic Login Flow​

1. User goes to console.solucao42.com.br
2. Enters company slug
3. Chooses login method:
   - Email & Password
   - Passwordless
   - SSO
   - Google OAuth
4. Completes authentication
5. (If 2FA enabled) Enters 6-digit code
6. Logged in

Company Slug​

The company slug identifies which organization you're logging into:

Example:

  • Your company: "Acme Corporation"
  • Company slug: acme-corp
  • Users enter acme-corp before logging in
Custom Login URL

You can create a custom login URL like login.acme.com that pre-fills the company slug for your users.

Session Management​

Session Duration​

After logging in:

  • Sessions last 7 days by default
  • Can be configured per organization
  • Activity extends the session

Ending Sessions​

Manual Logout:

  • User clicks Logout in profile menu
  • Session ends immediately

Automatic Logout:

  • Session expires after inactivity period
  • User is redirected to login page

Device Management​

Users can see their active sessions:

  1. Go to Profile → Security
  2. View Active Sessions
  3. See devices, locations, and last activity
  4. Revoke sessions from lost/stolen devices

Security Features​

Rate Limiting​

Login attempts are rate-limited to prevent brute-force attacks:

Limit TypeThreshold
Per IP address5 attempts per 15 minutes
Per email10 attempts per 15 minutes

Exceeded attempts result in temporary lockout.

Audit Logging​

All authentication events are logged:

  • Successful logins
  • Failed login attempts
  • Password changes
  • 2FA changes
  • SSO authentication

Administrators can review logs in Settings → Audit Log.

Best Practices​

For Administrators​

  1. Enable 2FA - Require it for all users or at least administrators
  2. Use SSO - If available, SSO provides the best security
  3. Regular audits - Review login logs for suspicious activity
  4. Strong policies - Enforce strong password requirements
  5. Educate users - Train users on security best practices

For Users​

  1. Use unique passwords - Don't reuse passwords from other sites
  2. Enable 2FA - Even if not required, enable it for your account
  3. Secure backup codes - Store them in a password manager
  4. Report suspicious activity - Tell admins if you see unusual logins
  5. Logout on shared devices - Always log out on public computers

Troubleshooting​

"Company not found"​

The company slug is incorrect. Check with your administrator for the correct slug.

"Invalid credentials"​

Email or password is wrong. Use "Forgot Password" if needed.

"Too many attempts"​

You've exceeded the rate limit. Wait 15 minutes and try again.

"2FA code invalid"​

  • Ensure your device's time is synchronized
  • Use the latest code (they expire every 30 seconds)
  • If still failing, contact your administrator to reset 2FA

Next Steps​

For Developers

Building authentication into your app? See the Authentication API Guide for technical integration.