# Authentication

> The rules for signing in to the platform: strong passwords, the initial password for students, reCAPTCHA on sign-up, Google sign-in and the device limit.

The authentication screen sets the rules for signing in to the platform. For example: every password needs 8 characters, and each student stays signed in on up to 3 devices. It does not change the look of the login screens.

## How it works

The screen is in **Settings > Security > Authentication**. It applies to students and administrators. It has four tabs:

| Tab | What it sets |
|---|---|
| **Passwords** | Whether the account requires strong passwords, with which criteria, and what a new student's initial password is |
| **Bot protection** | Google's reCAPTCHA on the free sign-up on the login page |
| **Google** | Whether students can sign in with their Google account. It uses the credentials of your Google Cloud project |
| **Devices** | On how many devices a student stays signed in at the same time |

The four tabs are one form. Change what you want on all of them. Then click **Save now** once, in the bar that appears at the bottom.

This screen handles the rules. The look of the login, sign-up and password recovery screens (logo, color, image) is in [Access screens](https://help.cademi.cloud/en/configuracoes/telas-de-acesso.md). The free sign-up channels are in [Student settings](https://help.cademi.cloud/en/configuracoes/cadastro-de-alunos.md).

## Passwords

### Strong passwords

**Require strong passwords** applies your criteria to every password created or changed on the account. It applies to students and administrators.

**The most important rule:** turning on strong passwords does not lock anyone out. Passwords in use keep working. Open sessions stay open. The rule applies the next time someone sets a password.

With the requirement on, **Protection level** and **Password criteria** appear:

| **Protection level** | Minimum length | Requires |
|---|---|---|
| **Standard** | 8 characters | 1 uppercase letter, 1 lowercase letter and 1 number |
| **Reinforced** | 10 characters | 1 special character, 1 uppercase, 1 lowercase and 1 number |
| **Maximum** | 12 characters | 2 special characters, 1 uppercase, 1 lowercase, 2 numbers and 4 letters in total |
| **Custom** | Whatever you set | The screen selects it on its own when you change any criterion |

The **Password criteria** are:

- **Minimum length**, 6 to 128 characters;
- **Special characters**;
- **Uppercase letters**;
- **Lowercase letters**;
- **Numbers**;
- **Letters in total**.

Each criterion has a minimum count. Enter 0 to not require a category.

The **Preview** helps you see the rule:

- With strong passwords on, it shows a sample password that meets the criteria. **Generate another example** shows another one. The sample is only there so you can see the length and mix you are requiring.
- With strong passwords off and a **Default password** filled in, it shows that password.

With strong passwords off, a new or changed password needs at least 6 characters.

### Initial password for new students

When a student is created, the platform sets their first password. This applies to purchase, import, free sign-up and students created by your team. The password goes in the welcome email ([Emails](https://help.cademi.cloud/en/configuracoes/e-mails.md)).

How the platform sets the password:

- **With strong passwords on**: a random password that meets the criteria. Each student gets a different one.
- **With strong passwords off**: you choose in **Use student information as the initial password**. The options are **Do not use student information**, **Use email as the initial password** and **Use tax ID as the initial password**.

With **Do not use student information**, **Default password** appears:

- Filled in, it is the same password for every new student. It needs at least 6 characters.
- Left blank, each student gets an individual password, generated automatically.

With **Use tax ID as the initial password**, a student without a document gets an automatically generated password.

**Attention:** email and document are easy to find out. A default password is the same for your whole base. The safest option is to turn on strong passwords: each new student gets a random password that follows your criteria.

### Password recovery and change

Someone who forgot their password clicks **Forgot your password?** on the login screen. The person receives a link by email. The link is valid for 3 hours. The current password keeps working until the person completes the link.

Your team can also act from the student's profile in the dashboard ([Student profile](https://help.cademi.cloud/en/alunos/perfil-do-aluno.md)):

- **Resend welcome email** resets the password and emails it. The new password follows the same rule as the initial password.
- **Change password** sets the password you type.

**Attention: this is where most mistakes happen.** **Resend welcome email** changes the student's password. The previous password stops working. With a **Default password**, or with email or document as the password, the student goes back to that password. Otherwise, they get a new random password. You can resend once per student every 10 minutes.

Students change their own password with **Change password**, in their profile in the student area. All these passwords follow the rules on this tab.

## Bot protection

**Bot protection** asks for Google reCAPTCHA's "I'm not a robot" check. It protects the free sign-up form on the login page against automated submissions. It uses the keys from your own reCAPTCHA registration.

1. Turn on **Bot protection**.
2. In the **reCAPTCHA credentials** block, click **Create keys in Google reCAPTCHA**.
3. At Google, create reCAPTCHA v2 keys, "I'm not a robot" checkbox type, for your platform's address.
4. Paste the **Site key**.
5. Paste the **Secret key**.
6. Click **Save now**.

Without both keys, the screen does not save with the protection on.

The check does not appear:

- on login;
- on Google sign-in;
- on the sign-up form on an external site.

If Google does not respond to the check, the sign-up is refused. The person tries again.

## Google

**Google sign-in** shows the **Sign in with Google** option on the students' login and sign-up screens. It is for students only. Administrators sign in with email and password. An email that belongs to an administrator cannot sign in through Google.

How it works for the student:

- Google must have verified the account's email. Otherwise, the sign-in is refused.
- An existing student signs in with Google through their email. This works even with free sign-up off.
- The Google account becomes linked to that student. Another Google account with the same email does not take its place.
- If the student changes their email on Google, they keep signing in through the linked account.
- Someone with no account is only created if two conditions are true: **Allow sign-up on the login page** is on in **Settings > Students**, and the account still has room within the plan's student limit.
- This new student starts with the free sign-up mark and gets the account's free delivery. They get no password by email: they sign in with Google.
- The free sign-up's **Authorized domains** only limit the creation of new students through Google. An existing student signs in with Google even with an email from another domain.

### Turn on Google sign-in

1. Turn on **Google sign-in**.
2. In the **Google Cloud credentials** block, click **Open Google Cloud Console**.
3. In your project, create an OAuth client ID credential for a web application.
4. Copy the **Authorized redirect URL** that the screen shows.
5. In the Google Cloud Console, register exactly that URL under "Authorized redirect URIs".
6. Paste the **Client ID** generated by Google.
7. Paste the **Client Secret** generated by Google.
8. Click **Save now**.

Without both fields, the screen does not save with sign-in on.

## Devices

**Concurrent student access** sets on how many devices each student stays signed in at the same time. In **Limit per student**, enter 1 to 999. Left blank, the default of 3 devices applies.

A device is a browser where the student signed in. If they come back through the same browser, it is the same device.

Think of the limit as a number of seats. Each new device takes a seat. When the seats run out and the student signs in on one more device, Cademí signs out the devices with the oldest sign-in. It signs out as many as needed to fit the limit. The sign-in that just happened stays.

The signed-out device loses its session right away, including "remember me". This is how the platform discourages account sharing: whoever lends the password is signed out when the other person signs in.

**Attention: this is where most mistakes happen.** Pedro signs in on his laptop, his phone and his tablet. The limit is 3. Then he signs in on his work computer. Result: the laptop, where he signed in first, is signed out. Pedro thinks he was signed out out of nowhere. To avoid this, raise the **Limit per student** if using several devices is legitimate.

- Lowering the limit does not sign anyone out right away. The rule applies at each student's next sign-in.
- Administrators have no device limit.
- Signing out (logout) does not free the seat. The device keeps counting until a new sign-in beyond the limit signs it out.
- Students do not see a list of devices.
- The events go to the **Logs** of the student's profile in the dashboard: **New device registered** and **Device removed because the device limit was exceeded**.

Raise the limit when a family or a class uses the same account on purpose. Lower it when you want to stop account sharing.

## Good to know

- **Changing the password rules does not change anyone's password.** Whoever already has a password keeps signing in. The rule only applies to the next password created or changed.
- **Resend welcome email resets the password.** If the student only forgot their password, send them to **Forgot your password?**. The current password keeps working until they complete the link.
- **Document as login.** Cademí can set up an account to sign in with the document instead of the email. This applies to students and administrators. In that case, the login field is the document. The email is still the contact address.
- **Same email for an administrator and a student.** There is a single login form, and the platform tries the administrator password first. **Forgot your password?** for that email resets the administrator's password. Google sign-in is blocked for that email. Give the two different emails.
- **Two-factor authentication is for administrators.** Each one turns it on in their own profile ([Administrators](https://help.cademi.cloud/en/configuracoes/administradores.md)). Students have no second step.

## Frequently asked questions

**I want to require strong passwords. Will anyone lose access?** No. Passwords in use keep working. The criteria apply when someone creates or changes a password.

**Why was the student signed out out of nowhere?** They probably signed in on another device and went over the limit. Someone else may also have signed in with their password. Check the **Logs** on their profile. If using several devices is legitimate, raise the **Limit per student**. See also [Why the student cannot access](https://help.cademi.cloud/en/alunos/por-que-o-aluno-nao-acessa.md).

**I turned on Google sign-in. Why does the button not show?** Check that **Client ID** and **Client Secret** were filled in and saved. If Google shows an error on sign-in, check the **Authorized redirect URL**. It must be registered exactly the same in the Google Cloud Console.

**Does the reCAPTCHA apply to login?** No. The protection applies to the free sign-up form on the login page. Login with email and password does not ask for the check.