Security and single sign-on

Anyone can manage their own password from their profile. Everything that applies to the whole workspace, single sign-on and automatic provisioning, lives on one page: account menu at the top right, then Company, then Security. That page is visible to owners and admins only.

It has two tabs, Authentication and Provisioning (SCIM).

Passwords

Passwords are at least 8 characters. Temponia also checks new passwords against public lists of passwords known to have leaked in past breaches, and refuses the ones that appear there, so a password that works elsewhere may still be rejected here.

To change your own password, open the account menu and select View Profile. Type the new one under New Password. A Current password field appears as soon as you start typing, because you need the old password to set a new one. Then select Save Changes.

People invited into a workspace, and people who have only ever signed in through SSO, may have no password at all. Their profile shows a Set a password button instead, which emails them a link.

If you are locked out, use Forgot your password? on the sign-in page. The link in that email is valid for six hours.

Sessions and lockout

• You are signed out automatically after 7 days without activity.
• Ticking Remember Me? on the sign-in page keeps you signed in for 2 weeks.
• After 5 failed sign-in attempts the account is locked. It unlocks by itself after 5 minutes; nobody has to do anything.
• Archiving a user stops them signing in, through a password and through SSO alike. SSO never silently re-enables an account an admin has disabled.

Signing in with Google or Microsoft

The sign-in page offers Sign in with Google and Sign in with Microsoft. These work on every plan and need no setup. They are hidden only once you run SCIM against your own identity provider, so that provisioning stays the single way in.

The match is on email address. If the address returned by Google or Microsoft belongs to a user in the workspace, that person is signed in. If it does not, what happens next depends on the provisioning rules below. Workspaces with the Xero integration connected also get a Xero sign-in button on the same page.

Connecting your own identity provider

Configuring your organisation's own identity provider is an Enterprise feature. It is available during the trial as well, so you can set it up before committing. Two are supported:

• Microsoft Entra ID, over OIDC
• Okta (OIDC)

Open Security, stay on Authentication, and select the card for the one you want.

1. For Entra, fill in Tenant ID (recommended). The issuer is derived from it. Issuer URL (optional override) is only needed if the derived one is wrong. For Okta, fill in Issuer URL directly.
2. Fill in Client ID and Client Secret (replace). Leaving the secret blank keeps the one already stored.
3. Copy the Redirect URI shown in the panel into your identity provider. It is https://yourcompany.temponia.com/auth/oidc/entra/callback, or .../okta/callback, where yourcompany is your Temponia subdomain. The scopes requested are openid email profile.
4. Select Save Changes.

Once saved, a Sign in with Microsoft or Sign in with Okta button appears on your workspace's sign-in page.

Requiring SSO

Require SSO forces everyone through a configured identity provider. The password field, the Remember Me? tick box and the Login button all disappear from the sign-in page, leaving only the provider buttons. You cannot switch it on before a provider is configured, and the form will tell you so: "Enable at least one SSO provider before requiring SSO."

Just-in-time provisioning

Allow Just-in-time provisioning creates an account the first time someone signs in through SSO, rather than requiring an invitation. It only applies to addresses in Allowed email domains for JIT, which is required as soon as JIT is on. Accounts created this way get the ordinary user role, so check Roles and permissions afterwards if someone needs more.

The domain list is the boundary. With JIT on, anyone who can authenticate at your identity provider with an address on that list gets an account and a seat on your subscription. Keep the list to domains you control.

SCIM provisioning

SCIM lets your identity provider create, update and deactivate Temponia users directly, so leavers lose access without anyone touching Temponia. It is an Enterprise feature, again available during the trial, and lives on the Provisioning (SCIM) tab.

1. Select Generate Token. The token is shown once and never again, so copy it now.
2. Copy the SCIM Base URL, which is https://yourcompany.temponia.com/scim/v2.
3. Paste both into your identity provider's provisioning settings.
4. Tick Enable SCIM and select Save Changes. Status flips to Active.

Users and groups are both supported. Deleting a user through SCIM archives them in Temponia rather than destroying their history, so their tracked time stays in your reports.

Turning SCIM on deliberately takes over from just-in-time provisioning: the JIT controls grey out, and someone who is not provisioned is told to ask their admin for access rather than being created on the spot. Use Generate new to rotate the token; existing tokens stop working immediately.