Appian Authentication

Purpose

The Appian Authentication page in the Admin Console allows you to control password strength requirements and password expiration policies.

Access

To access the Appian Authentication page, go to the Admin Console. Then, in the left navigation menu, under Authentication, click Appian Authentication.

Settings

The Appian Authentication page contains the following settings.

Password storage

Appian hashes passwords using an industry standard hashing algorithm and only stores the hashed values of passwords. When passwords are entered, they are similarly hashed using the same algorithm, and the result is compared against the stored value.

Password format

The Password Format section allows setting the following:

• Minimum Password Length: The minimum number of characters allowed in a password. The default is 1.
• Minimum Number of Alphabetic Characters: The minimum number of characters from the English alphabet (A-Z and a-z) allowed in a password. The default is 0.
• Minimum Number of Lowercase Characters: The minimum number of lowercase characters from the English alphabet (a-z) allowed in a password. The default is 0.
• Minimum Number of Uppercase Characters: The minimum number of uppercase characters from the English alphabet (A-Z) allowed in a password. The default is 0.
• Minimum Number of Numeric Characters: The minimum number of numerals (0-9) allowed in a password. The default is 0.
• Minimum Number of Special Characters: The minimum number of special characters allowed in a password. The default is 0. Special characters include: ! " # $ % & ' ( ) \* + , - . / : ; < = > ? @ [ \ ] ^ _ \` { | } ~
• Minimum Password Age: The number of days a user must wait between password changes, where one day is defined a 24 hour period and not a calendar day.
• Prevent Reuse of Previous Passwords: How many of their previous passwords should a user not be able to choose as a new password? Valid values are between 0 and 24, inclusive. The default is 1, meaning that the user's current password may not be reused but that other previous passwords may be reused.
• Passwords cannot contain usernames: When checked, the user's password cannot contain their username. Unchecked by default.

The configurations in this section apply only to passwords managed by Appian and do not apply to accounts that authenticate with LDAP or SAML.

For information and details regarding the configuration of the Remember Me Authentication, see also: Remember Me Authentication

Appian Cloud installations have different default settings than self-managed installations. The following default password policies are in place for Appian Cloud users:

• Passwords must be at least 7 characters long.
• Passwords must contain at least 1 numeric character.
• Passwords must contain at least 1 letter.
• Passwords must be different from the previous 4 passwords used.

Remember me

The Remember Me section allows you to toggle the Remember Me password setting on or off. Toggling this setting on allows you to configure the length of time that a user will remain signed in without having to enter their username and password.

By default, this setting is configured so that users must provide their username and password once every two weeks for each browser on which they access Appian.

This setting does not apply to Administrators. Administrators are automatically logged out when their session expires, which is based on the Session Timeout period.

This setting only applies to users who authenticate via Appian authentication or LDAP. For more information about enabling Remember Me for SAML, see SAML for Single Sign-On.

See also: Remember Me on the Authentication page.

Session timeout

Session timeout values can be configured differently for basic users and system administrators in your Appian environment. For both types of user, the minimum valid value is 10 minutes, and the maximum valid value is 480 minutes (8 hours).

The session timeout values apply to all applications in your Appian environment.

Setting	Description	Default
Basic User Idle Session Timeout (Minutes)	Specifies the number of minutes that a basic user can remain inactive before the system signs them out.	65
System Administrator User Idle Session Timeout (Minutes)	Specifies the number of minutes that an administrator can remain inactive before the system signs them out.	65

How session timeout works

Five minutes before the session expires, the system displays a default warning message to the user:

You cannot customize this warning message.

After five more minutes of inactivity, the system signs the user out. The user is automatically redirected to the sign-in page or single sign-on page, depending on your configuration.

Once the user signs back in, the user start page displays. The system does not return the user to the page they were using when their session expired.

Password expiration

The Password Expiration section allows setting the following:

• Expire Passwords: Should passwords expire after a certain amount of time? The default is that passwords do not expire.
• Maximum Password Age: The number of days after which a password expires and must be reset.
• Warn Users Before Password Expiration: Should users see a warning when they log in when their password is about to expire? The value must be lower than the number you set for Maximum Password Age. The default is that there is no warning period.
• Password Expiration Warning Period: The number of days before a user's password expires where they will be warned about their impending password expiration.
• Expire Temporary Passwords: Should auto-generated passwords, such as those generated when a new user account is created or when an administrator resets a user's password, expire? The default is that they should expire.
• Maximum Temporary Password Age: The number of minutes after which a temporary, auto-generated, password expires and is no longer valid. When a temporary password expires, the user is not allowed to log in and must request that an administrator reset the password. The default is 10080 minutes, which is one week.
• Minimum Password Age: The number of days a user must wait after changing their password before they may change it again. The default is 0. This setting does not affect temporary passwords or the ability for an administrator to reset a user's password.

When a password expires, the user must change the password before they are allowed to proceed past the Appian log-in page.

The configurations in this section apply only to passwords managed by Appian and do not apply to accounts that authenticate with LDAP or SAML.

Appian Cloud installations have different default settings than self-managed installations. The following default password policies are in place for Appian Cloud users:

• Passwords expire every 90 days.
• Users are notified regarding password expiration 7 days before it happens.

Initial passwords for Appian Cloud are temporary passwords. The system prompts users to reset their password immediately after logging into Appian Cloud.

Forgot password

The Forgot Password section allows setting the following:

• Enable Forgot Password from Sign-In Page: Should users be able to reset their passwords from the sign-in page? If enabled, users will be able to reset their passwords by clicking the "Forgot your password?" link on sign-in page and following the steps provided.

• Password Reset Link Duration (Minutes): How long should password reset links be valid? A user following an expired link will need to re-enter their username to receive a new link before they can reset their password. When this value changes, the change is applied retroactively to existing links.

When this feature is enabled, only users that meet the following requirements will be able to reset their passwords:

• The user does not authenticate through LDAP or SAML.
• The user is not deactivated.
• The user's password is old enough to be reset.
• The user has a valid e-mail address.

If either SAML or LDAP are enabled for all users, the Enable Forgot Password from Sign-In Page checkbox will be disabled and unchecked because when these authentication features are enabled, Appian does not have control over users' credentials. If, however, only some users authenticate through LDAP or SAML, the feature can be enabled, and the "Forgot your password?" link will appear on the sign-in page for all users.

Use import customization files to change the value between environments with different authentication configurations.

Use of this feature can be audited through the Forgot Password Requests and Password Resets audit logs.

Account locking

User accounts that have difficulty supplying the proper credentials are temporarily locked (prevented from making a login attempt) when the user (or someone attempting to log in as the user) tries too many incorrect passwords. The system does this by keeping track of the number of failed login attempts for each account. The failed login count is reset automatically after some time has passed from the last failed attempt. This prevents the user from accumulating a large number of failed login attempts over a long period of time.

The Account Locking section allows setting the following:

• Lock Accounts After Failed Logins: Should accounts be locked after repeated failed login attempts? The default is that accounts are locked.
• Maximum Password Attempts: How many failed login attempts should it take for an account to be locked? The default is 6.
• Password Attempt Reset Duration: How many minutes after a failed login attempt should the counter for the number of failed logins be reset? The interval you specify should be long enough to ensure that a sufficient number of failed attempts accumulate before the counter is reset, should someone attempt to guess at a password by repeatedly submitting random values. The default is 30 minutes.
• Unlock Accounts Automatically: When an account is locked due to failed login attempts, should it be automatically unlocked after a certain time period? If automatic unlocking is disabled, accounts will remain locked until an administrator manually unlocks them. The default is that accounts should be automatically unlocked.
• Lock Duration: When an account is locked due to failed login attempts, how many minutes should it be locked for? The default is 30 minutes.
• Limit Number of Concurrent Sessions Per User Account: Should users only be allowed to have a certain number of sessions active at the same time? The default is that the number of concurrent sessions per user is not limited.
• Maximum Concurrent Sessions: How many sessions should a user be able to have open at the same time before they are no longer allowed to log in again?
• Deactivate Users Who Have Not Logged In Recently: Should users who have not logged in recently be deactivated? The default is that accounts are not deactivated due to inactivity.
• Idle User Deactivation Duration: How many days after their last successful login should a user account be deactivated.

  Note:  This setting also applies to sessions of users authenticating through SAML.

The failed login count is reset if the account is unlocked by an administrator.

When you specify a deactivation interval, that same interval must elapse before user accounts begin to be deactivated. For example, if you specify an inactivity deactivation interval of 90 (90 days) on April 1st, a user account that does not successfully log in between April 1st and June 30th is deactivated. In this scenario, a user account that has not logged in since January 1st also remains active until June 30th, as you did not activate the policy until 90 days after the user account became inactive.

User accounts that are deactivated due to inactivity are listed at the INFO level in db_PE_yyyy-mm-dd_hhmm.log in the <APPIAN_HOME>/logs/ directory.

The system user Administrator is never automatically deactivated.

Appian Cloud installations have different default settings than self-managed installations. The following default password policies are in place for Appian Cloud users:

• Users who have not logged in are considered inactive after a period of 90 days.

Activity from the Appian Mobile applications does not count towards the number of active sessions a user has and the number of requests from the mobile applications.

See also:

• User Deactivation Logging
• Reactivating Users
• Unlocking Users

Multi-factor authentication

Appian can be configured to require multi-factor authentication (MFA) for users that sign in with Appian authentication. This adds an extra layer of security to the sign-in process since users must provide their Appian username and password, and a custom verification code.

Before you enable MFA, the Outbound Email Toggle must be enabled so Appian can send verification codes to users. Also note that when MFA is enabled, users cannot reset their own password unless they have configured an authenticator app. Otherwise, they will need to request that a system administrator do it for them.

In the Multi-Factor Authentication, you can enable MFA using the following settings:

• Enable Multi-Factor Authentication: Select this checkbox to require a group of users to sign in using MFA. By default, this checkbox is deselected.
• Authentication Group: Select the group that is required to sign in using MFA. These users must be configured to use Appian authentication. MFA will not apply to users configured to use SAML, OpenID Connect, PIEE, or LDAP.
• Email Verification: When enabled, users receive an email with a verification code that must be entered to complete the sign-in process. This setting cannot be disabled when MFA is enabled because email is required as the fallback method for users who have not yet configured an authenticator app.
• Authenticator App: When enabled, users enter a verification code from an app to complete the sign-in process.

When both email verification and authenticator app verification are enabled, users can select their preferred verification method when they sign in.

Scroll or drag to pan · ⌘+/⌘− to zoom · Esc to close

Email verification

When MFA is enabled, users are required to enter their Appian username and password. Then, the user will receive an email with a verification code that must be entered to complete the sign-in process. This code is valid for 5 minutes, after which a new code must be requested.

If the user requests a new verification code, the existing verification code will be invalidated.

Users only have three chances to enter a verification code before the code is invalidated. Each incorrect entry of the code counts towards Account Locking.

Users are also limited to three verification code requests per fifteen-minute window to maintain sign-in performance and security.

Authenticator apps

Users are required to configure an authenticator app during their first login after this feature is enabled. After initial setup, users can modify their authenticator app configuration in their user settings, which generates a new secret key and invalidates the previous setup.

Users can configure any authenticator app that generates verification codes using the time-based one-time password (TOTP) protocol. This includes popular apps like Authy, Google Authenticator, and Microsoft Authenticator.

Use import customization files to change the value between environments with different authentication configurations.

Terms of service

The Terms of Service Agreement section allows you to set a message on the sign-in page that users must click to accept before entering the system.

• Require Users to Accept Terms of Service Before Logging In: Should users be required to accept terms of service before accessing the site?
• Terms of Service: The message that should appear on the sign-in page.

When you change the terms of service, all remember me authentication sessions will be invalidated and users will need to input their username and password the next time they sign-in to Appian.

Feedback