This article explains the login security settings in Learnster: password rules, Multi-Factor Authentication (MFA), the failed-login block, session length, and which login methods your users can use.
ℹ️ The only login setting you can change yourself is Allowed authentication methods. Password rules, MFA, the failed-login block and session length are managed by Learnster. Contact Learnster support if you want any of them changed.
Overview
Setting | Default | Who can change it |
Password rules | At least 8 characters, upper- and lowercase letter, digit | Hard coded |
Multi-Factor Authentication (MFA) | Off | Learnster, per workspace |
Failed-login block | Off | Learnster |
Session length | 14 days | Learnster |
Allowed authentication methods | All methods your workspace has | You, under Settings → General (when SSO is on) |
Password rules
Password rules are the same for every Learnster workspace. A new password must:
be at least 8 characters long
include an uppercase letter, a lowercase letter and a digit
not be too similar to the user's own details, and not be a common password
If a password doesn't meet the rules, the user sees "Password must contain" followed by what's missing.
If you use SSO, your identity provider handles passwords and lockouts instead.
Multi-Factor Authentication (MFA)
MFA adds an extra step when users log in with a password: after entering their password, they're asked for a code sent by email. It's switched on for the whole workspace and is off by default. It also applies to the Nelson Instructor App.
There's no MFA setting in Studio. To turn MFA on or off, contact Learnster support.
Failed-login block
The failed-login block is off by default. When Learnster has switched it on, 5 failed attempts lock that login for 5 minutes, and the user sees "Too many failed login attempts. Please, try again in {time}." The user can try again once the time has passed, or reset their password.
Session length
By default, users stay logged in for 14 days. Learnster can set shorter or longer session lengths, separately for admins, for other users and for the mobile app.
When a session ends, users see "You have been logged out automatically due to your organization's security rules for user sessions. Please sign in again." The same message appears after a password change. They just need to log in again.
Allowed authentication methods
If your workspace uses SSO and has more than one login method, you choose where each method can be used. Go to Studio → Settings → General and find Allowed authentication methods.
The columns are Learnster U, Learnster Studio and Learnster Mobile App.
The rows are the login methods your workspace has, for example Learnster Native Login, Azure SAML, Google Workspace SAML, SAML SSO and OpenID Connect.
For the Mobile App, only Learnster Native Login and OpenID Connect (Auth Code Flow) can be changed.
Each column must keep at least one method. Otherwise you'll see "At least one type should be selected."
You need permission to edit general settings to save.
This setting only chooses where existing login methods can be used. It doesn't set up an SSO connection and it doesn't turn on MFA. See the SSO articles in this collection for setting up a connection.
Common questions
Why was I logged out? Your session reached its time limit, or your password was changed. Log in again.
Why can't I log in after several tries? The failed-login block may be on for your workspace. Wait 5 minutes or reset your password.
Can we require special characters, block reused passwords or force regular password changes? These options aren't on by default. Contact Learnster support to discuss them.
Users can't use a login method any more. Check Allowed authentication methods under Settings → General: the method may have been unticked for Learnster U, Studio or the app.