The sign-in experience

What your users see, in the order they see it, and where each of your settings takes effect.

Stage 3 only appears when there is something to set up. A returning user goes from 2 to 4.

A tenant sign-in page: username, password, an ALTCHA captcha already verified, and the Sign in button. — A sign-in page with the default theme and an ALTCHA captcha.

Your branded page asks for a username and password and shows your captcha. When the form is submitted the password is checked against your directory, and three other things are evaluated:

Check	Set on	If it fails
The address is not blocked after repeated failures	Lockout policy	The attempt is refused until the block expires.
The network is allowed	Network policy	Refused, or sent to a second factor, depending on the rule.
The device meets your requirements	Device policy	Refused, or sent to a second factor.

A policy in watch mode records its decision and stops nobody.

2. The second factor#

If a second factor is required, the user is asked for one they have enrolled: a code from their authenticator app, a code sent by email or SMS, or their passkey.

Try another way lists the other methods that user can use. A recovery code is offered only to someone who has recovery codes.

3. First-time set-up#

Shown only when there is something to set up, in this order:

Step	When it appears
Set up an authenticator	An authenticator is required and the user has none.
Add a passkey?	Passkeys are enabled and the user has none. They can choose Not now, and are asked again two weeks later.
Save your recovery codes	Recovery codes are enabled, and the user now has a factor to recover. Shown once.

4. The session#

The user returns to the page they asked for, signed in. Your application receives their signed identity. See Read the signed-in user.

Forgotten passwords#

Forgot password? is offered only when your directory is in read and write mode. A user who has an authenticator is asked for a code before they can set a new password, so access to someone's mailbox is not enough to take over their account.

In read-only mode the link is not shown, and passwords are changed in your own application.

Signing out#

Link to /verisco/logout on your own hostname. It ends the session with VERISCO and with the sign-in realm, so the next visit asks for credentials again.

The user's own page#

In gateway and connector mode each user has a page at /verisco/me on your hostname. It shows their sessions and their devices, lets them set up a device, and lets them sign out.

What a refusal looks like#

Every refusal is recorded with its reason on Sign-in Activity in your console. The person refused sees a short message; the full reason is for you.

The user sees	Usual cause
"Invalid username or password"	A wrong password, or a user who is not in your directory.
A message that the account is temporarily locked, with the time to wait	Lockout after repeated failures.
"Please complete the captcha check"	The captcha was not solved, or its key is misconfigured. See Captcha.
A message that the sign-in was refused	Network policy or device policy in enforce mode.

Something missing or wrong on this page? Tell us and we will fix it.