Login Config

Login Config controls how admin users log in to the Kiwire admin panel — password complexity rules, session lifetimes, allowed login methods, lockout policies, and two-factor authentication enforcement.

'alt' => 'Dashboard overview', 'caption' => 'The default Kiwire dashboard layout', 'screenshot' => true, 'class' => '', ]) Drop images into: public/assets/img/docs/{page}/{filename} --}}

Image not uploaded yet public/assets/img/docs/login-config/overview.png

Password Policy

Setting	Default	Description
Minimum Length	8	Minimum number of characters required for all admin passwords.
Require Uppercase	Off	Password must contain at least one uppercase letter (A–Z).
Require Lowercase	Off	Password must contain at least one lowercase letter (a–z).
Require Numbers	Off	Password must contain at least one numeric digit (0–9).
Require Special Characters	Off	Password must contain at least one special character (e.g., ! @ # $ %).
Password Expiry (days)	0	How many days before an admin's password must be changed. Set to 0 to disable expiry. When expired, the admin is prompted to set a new password on next login.
Prevent Reuse (last N)	0	Number of previous passwords that cannot be reused. Set to 0 to allow reuse.

Session Settings

Setting	Default	Description
Session Lifetime	120 min	Maximum session duration. The admin must re-authenticate after this period, even if they were active.
Idle Timeout	30 min	Session is invalidated after this many minutes with no requests. Configurable here or via the SESSION_IDLE_TIMEOUT environment variable.
Allow Concurrent Sessions	Off	When off, logging in from a new device immediately terminates any existing session for that account. When on, multiple simultaneous sessions are permitted.
Remember Me Duration	30 days	How long the "remember me" cookie remains valid. Applies only if the admin ticks the remember me checkbox at login.

Login Methods

Method	Description
Password Login	Standard email/password login. Always enabled — cannot be disabled.
SAML SSO	Single Sign-On via SAML 2.0. Requires a configured SAML connector in the Connectors module. When enabled, a "Sign in with SSO" button appears on the login page.

Failed Login Lockout

Setting	Default	Description
Maximum Attempts	5	Number of consecutive failed login attempts before the account is locked.
Lockout Duration	15 min	How long the account remains locked. The admin or a superuser can manually unlock the account before this expires.

Two-Factor Authentication

Setting	Description
Enforce MFA for All Admins	Global toggle. When on, all admin accounts must enrol in TOTP-based MFA. Admins without MFA are redirected to the setup flow on every login until they enrol.
MFA Grace Period	Number of days after account creation during which MFA enrolment is optional. After the grace period expires, the admin is forced to enrol before accessing any page.

Required Permissions

view-login-config · update-login-config