site.ini [ReauthSettings] #

The block [ReauthSettings] of settings/site.ini, with 8 setting(s).

Never edit settings/site.ini itself: an update replaces it. Put the settings you change in an override, which wins over the shipped file:

• settings/override/site.ini.append.php for every siteaccess,
• settings/siteaccess/<siteaccess>/site.ini.append.php for one siteaccess,
• extension/<extension>/settings/site.ini.append.php in an extension (read when the extension is active).

Reauth #

"Verify it's you": before a sensitive action the signed-in user confirms who they are
again (the password and a passkey, see Factors[]) and is not
asked again for Minutes. Only the web pages ask (index.php and Velocity); REST, SOAP,
WebDAV, the expservices login and the command line are never asked. Anonymous visitors
are never asked. The groups and their switches are edited on setup/reauth.
Guide: doc/eng-us/guides/verify-its-you.md

enabled or disabled (all groups).

Default: enabled.

<?php /* #?ini charset="utf-8"?
# settings/override/site.ini.append.php
[ReauthSettings]
Reauth=enabled
*/ ?>

Minutes #

Minutes a confirmation counts.

Default: 10.

<?php /* #?ini charset="utf-8"?
# settings/override/site.ini.append.php
[ReauthSettings]
Minutes=10
*/ ?>

MaxFailures #

Wrong answers in a row after which the user is signed out.

Default: 5.

<?php /* #?ini charset="utf-8"?
# settings/override/site.ini.append.php
[ReauthSettings]
MaxFailures=5
*/ ?>

Factors #

How the user confirms: the first combination whose every way the user has is asked, with
the later ones of as many ways offered beside it (never a weaker one). Ways: password,
passkey, code (the authenticator app of a two-step sign-in, see CodeHandlers[]).
The default: the password AND a passkey; without a passkey the password and the code;
without either the password alone; an account without a password uses a passkey.

Default: a list of 4: password+passkey, password+code, password, passkey.

<?php /* #?ini charset="utf-8"?
# settings/override/site.ini.append.php
[ReauthSettings]
# an empty "Factors[]" first replaces the shipped list; without it the items are added
Factors[]
Factors[]=password+passkey
Factors[]=password+code
Factors[]=password
Factors[]=passkey
*/ ?>

Groups #

The groups, each [ReauthGroup_<name>] with Enabled=true|false and Rules[].

Default: a list of 6: account, users, system, export, delete, content.

<?php /* #?ini charset="utf-8"?
# settings/override/site.ini.append.php
[ReauthSettings]
# an empty "Groups[]" first replaces the shipped list; without it the items are added
Groups[]
Groups[]=account
Groups[]=users
Groups[]=system
Groups[]=export
Groups[]=delete
Groups[]=content
*/ ?>

CodeHandlers #

Classes implementing expReauthCodeHandler: they check the code of a two-step sign-in app.
expReauthTotpCode reads the codes of sevenx_authentication_2fa when that extension is active.

Default: a list of 1: expReauthTotpCode.

<?php /* #?ini charset="utf-8"?
# settings/override/site.ini.append.php
[ReauthSettings]
# an empty "CodeHandlers[]" first replaces the shipped list; without it the items are added
CodeHandlers[]
CodeHandlers[]=expReauthTotpCode
*/ ?>

TriggerHandlers #

Classes implementing expReauthTriggerHandler: extensions decide themselves that a request
asks, naming one of the groups above (it asks only while that group is on).

Default: an empty list.

<?php /* #?ini charset="utf-8"?
# settings/override/site.ini.append.php
[ReauthSettings]
# an empty "TriggerHandlers[]" first replaces the shipped list; without it the items are added
TriggerHandlers[]
*/ ?>

BulkCount #

The number of items at which a removal counts as "bulk" (the rule token bulk).

Default: 2.

<?php /* #?ini charset="utf-8"?
# settings/override/site.ini.append.php
[ReauthSettings]
BulkCount=2
*/ ?>

Related #

• All blocks of site.ini
• All INI files
• The settings page

Generated by ./console exp:help:examples from settings/site.ini. Do not edit this page: change the source and generate again (how). Free documentation: GFDL 1.3 or later.