Security settings
Password rules, sign-in modes, sessions and the network allow-list.
Owners set organization-wide rules under Settings → Security. Every change is recorded in the audit log.
Password sign-in
| Mode | Use when |
|---|---|
| Allowed | Some people don't use SSO. |
| Owners only | Everyone uses SSO, but owners keep a password as break-glass access in case your identity provider is down. |
| Off | SSO only. |
Gatehouse won't let you turn off passwords until at least one SSO provider is active.
Password rules
- Minimum length: 12 by default, 10 to 64.
- Common passwords and passwords containing the person's email are refused.
- Lockout: after 5 failed attempts in a row (configurable), the account locks for 15 minutes (configurable). Admins can unlock early.
- Passwords are hashed with scrypt. Reset links expire in one hour and work once.
- Sign-in is also rate limited per IP address.
Two-step verification
Choose who must use it: nobody, owners, admins and auditors, or everyone. Optionally ask for it after SSO too. See Two-step verification.
Sessions
- Session length: how long a console sign-in lasts, 12 hours by default.
- Sign out after idle: in minutes. 0 means no idle limit.
People see their devices under Your account and can sign out the others. Admins can sign a person out everywhere.
Agent tokens are separate: access tokens last one hour and refresh tokens rotate on each use.
Network allow-list
Enter IPv4 or IPv6 ranges in CIDR form, one per line, for example 10.0.0.0/8 or 203.0.113.0/24. When the list isn't empty, only those networks can use the console, the API, the MCP endpoint and SCIM.
Gatehouse refuses a list that doesn't include the address you're saving it from, so you can't lock yourself out by mistake.
Behind a load balancer or reverse proxy, set GATEHOUSE_TRUST_PROXY so Gatehouse sees real client addresses. See Configuration.