Sign-in – IIZI 5.0

An application signs its users in with IIZI's own SignIn screens. The launch of an application is anonymous; the user signs in inside it.

Identifier first, then the password; sign-in by user name or e-mail address; remembered accounts and an account menu.
Password fields with a reveal button and the Browser's autocomplete attributes; a new password is typed twice, at sign-up and at every change.
The password reset link and the verification e-mail, sent again on request. Every link SignIn mails points to the address the user reached the server by – through a TLS-terminating reverse proxy, the proxy's https address – and a reset link opens the “Set a new password” screen at once.
The first screen has a light / dark / auto theme button under the language button.
Failed sign-ins are throttled per client source address.
A remembered account whose device sign-in was revoked is told “This device is no longer signed in. Choose an account to sign in again.”

Two-step verification and passkeys

The second factor is chosen: a passkey, recommended where the device supports one, or an authenticator app (TOTP). The user also chooses which one is asked for first at sign-in. Recovery codes cover a lost device.
Setting up an authenticator app shows its QR code black on white, with the account and the server named; returning shows the same code, “Start over” makes a new one, a fifth wrong code ends the set-up, and a code refused because the device's clock is off says by how much. The code screens show the server's time. IIZI computes the TOTP codes itself.
Passkeys in the Browser: a passkey button and passkey autofill on the sign-in screen, the passkeys screen of the account, and a passkey as the second factor. A passkey asserted with user verification counts as both steps. A passkey registered during an account recovery is not accepted as a second factor for 24 hours.
A sign-in policy per server and per application, in iiziGo's settings editors. “Sign-in & security” shows “Two-step verification: Off – Turn on” until a second factor exists.
“Stay signed in?” A device can resume its sign-in, and the account lists its signed-in devices.

A user signs in to an application only through an enabled group the application allows, or a group that allows all applications. A refused user is told “no access” only once the whole sign-in, second step included, is done.
The group list decides who may sign in, not who sees the application's pages: an application that does not gate itself is public. A session nobody has signed in to is shown every page it opens, whatever groups the application allows.
An account created through an external provider cannot be signed in to with a password.

E-mail address. A user changes the account's e-mail address in “Sign-in & security”: the new address takes effect once the link mailed to it is opened, the page shows “Verified” at once, also in another tab, and the old address is told. “Resend” sends the verification mail at once and says whether it went.
Shared addresses. Several accounts may use one e-mail address: a sign-in with a shared address asks for the user name instead, and a password reset for it mails one link per account.
Account notices. The user gets a mail about every change to the account – a password changed or reset, an authenticator app set up or removed, recovery codes renewed, a passkey added, renamed or removed, a device trusted, devices signed out, the preferred second factor changed – saying when, from which device, client address and approximate place, and by whom, in English, French or Swedish. “Sign-in & security” turns the notices off, except those about the password, a removed method, a reset and the setting itself.

“Edit user” sets a user's e-mail address and password (“Must change password at next sign-in” ticked by default). The new address takes effect at once, unverified; a verification mail goes to it and a notice to the old one.
“Sign out of all devices” ends the user's sessions in every application and revokes every device; “Reset sign-in methods” also deletes the user's passkeys, authenticator app and recovery codes.
“Confirm it is you”: before an administrator changes another account's e-mail address or password, signs it out or resets its sign-in methods, ServerAdmin asks for the password again when the administrator signed in more than 5 minutes ago.
An administrator with no e-mail address, or still on the installation's placeholder address, is asked for one at sign-in before ServerAdmin opens.