Registration, invitations and sign-in

Registration

On obscenter.site, and on any install where registration is open, the sign-in page has a Registration button. You enter an email address, a password of at least eight characters, and your organisation's name, such as your company, team or project. You become the owner of a new, empty organisation and are signed in straight away. An address that already has an account is refused, with a hint to sign in instead or to ask a colleague for an invitation.

On obscenter.site the new organisation's 15-day free trial, with 1 server and unlimited websites and mobile apps, starts at that moment. See Plans and limits.

A confirmation mail, "Welcome — confirm your address", carries a link that is valid for 48 hours. Until you click it, the dashboard answers most requests with "confirm your address first". You can ask for the mail again once a minute, up to five times a day.

The install's administrator controls registration under Settings → Accounts → Organisations → Open registration. It is open by default, on self-hosted installs too. On a private install, close it once your own people have accounts. With it closed, the registration endpoint answers that registration is not open, and nobody new can sign up through Google either. Mail me when someone signs up tells the administrator about each new registration.

Invitations

An administrator invites people from Settings → Accounts → Invite by mail, with an email and a role: Admin, Member or Viewer. Teams can be included too. The mail's subject reads "[Obscenter] … invited you to …". The link is valid for seven days. Each address has one open invitation per organisation, and a new invitation replaces the old one. If the install could not send the mail, the administrator is given the link to pass on another way.

Following the link:

• A new address chooses a password and is in. The address counts as confirmed, because the invitation reached it.
• An existing account enters its own password, or is simply signed in already, and joins the organisation.
• A used or expired link says so. Ask for a new one.

Mail is sent through the install's email channel. See Email.

Sign in with Google

When the install has Google sign-in configured, the sign-in page shows Continue with Google.

• An account is matched by Google's stable account id first.
• With no link yet, an existing account is linked by its email address only if Google says that address is verified.
• An address with no account gets a new account and an organisation of its own, as long as registration is open.
• A blocked account is refused.

You can link or unlink Google yourself under Settings → UI → Sign-in methods. An account made through Google has no password until you set one there.

To configure it, the install's administrator creates an OAuth client in the Google Cloud console and opens Settings → Accounts → Sign in with Google. Enter the Client ID and Client secret, and paste the redirect address the card shows into the Google console. The redirect address is <PUBLIC_URL>/auth/google/callback. Instead of the card, you can set OBSCENTER_GOOGLE_CLIENT_ID and OBSCENTER_GOOGLE_CLIENT_SECRET in the server's environment. The secret is never sent back to a browser. The flow uses PKCE and a state check, and expires after ten minutes.

Sign in with your phone

On a shared or unfamiliar computer, choose Sign in with your phone. The screen shows a QR code. Scan it with a phone that is already signed in to Obscenter. The phone shows where the request comes from: the screen's address, country and browser. Approve it, and the screen is signed in to the same account. A code lives for two minutes. The code only names the request. A separate secret stays in the browser that asked, so a photograph of the screen cannot be used to steal the session.

Sessions and passwords

A dashboard session lasts 30 days and is renewed while you use it, so people who use it daily are never signed out. On a self-hosted install, SESSION_DAYS sets the length. The session is a cookie that is HttpOnly, SameSite=Lax, and Secure over HTTPS. Its server-side twin survives restarts. Passwords need at least eight characters. Changing your own password needs the current one, and ends your other sessions.

The sign-in book

Settings → Sign-ins records every attempt to get into the dashboard, accepted or refused, including names that do not exist. Each attempt is logged with its address, country, place, browser, operating system and method: password, Google, QR, invitation, registration or setup. The page shows:

• accepted and refused sign-ins over the period;
• Tried, no such account;
• Where from;
• Recent attempts, flagged when the place is new or when the sign-in came after several failures.

An organisation's admin sees their own members. The install's administrator sees everybody. Rows are kept for 180 days.

The brake

Failed passwords are slowed and then stopped, counted over a sliding 15 minutes:

• 8 failures for one account from one address stop that account from that address.
• 20 failures from one address stop that address.
• 40 failures on one account from anywhere stop the account. Addresses that signed in successfully in the last 90 days are exempt, so an attack does not lock the real owner out.

The answer is "too many failed attempts — wait fifteen minutes and try again". Every failed password also costs a one-second delay. The counters live in the database, so restarting the install does not reset them.

Blocks

From the sign-in book, an administrator can Block an account, with a reason. The block lasts 1 hour, 24 hours (the default), 7 days, 30 days, or until unblocked. A block ends the account's sessions at once. While it stands, its password, Google and QR sign-in, invitation acceptance, its personal agent key and its API keys are all refused. Unblock lifts it. Nobody can block themselves, or the last administrator who can still sign in.