Skip to main content

​
Roles, Sessions and Audit

​
Roles

Every user has one role per workspace (tenant). Roles are enforced by the API on every request.
  • Credential values are never shown back: the API returns •••••••• for every stored secret, also to administrators. Flows use them on the server.
  • Every workspace sees only its own data; there is no cross-workspace access except for platform administrators.
  • Roles can come from Active Directory groups or Entra ID app roles (see Enterprise SSO).

​
Sessions

  • Access tokens are valid for 15 minutes and are refreshed automatically while the browser tab is open.
  • A session ends after 60 minutes without activity, 12 hours after sign-in, on sign-out, or when it is revoked.
  • Sessions are revoked automatically when the password is changed or reset, the role changes, or the account is deactivated, rejected or deleted.
  • Users see and end their own sessions in Security & Audit; administrators can end all sessions of a user (lost device, suspected compromise).

​
Two-factor sign-in

  • With LDAP or Entra ID, MFA is enforced by your directory (for example Entra Conditional Access); Quixa does not ask for a second factor on top.
  • For local (break-glass) administrators, the installation can require an authenticator app (ADMIN_MFA_PROVIDER=Local in .env). It is set up with a QR code at the first sign-in and works without e-mail or internet access.
  • Other users can turn on e-mail codes. Entra ID users use the MFA of your Conditional Access policies.
  • A lost authenticator is reset by another administrator (Security & Audit → Reset authenticator); the user sets up a new one at the next sign-in.
  • After 5 wrong codes the sign-in has to start again; after 5 wrong passwords the account is locked for 15 minutes.

​
Passwords

At least 12 characters with three of: lower-case, upper-case, digits, symbols; not a common password; not containing the e-mail name. The same rule applies to registration, invitations, resets and changes.

​
Audit log

The audit log records, with time, user, IP address, user agent and outcome: Administrators filter and export it in Backoffice → Security & Audit (JSON lines or CSV). It can be forwarded to a SIEM in real time (hardening guide). Audit events are kept for 365 days by default (at least 90).