Signing In and Out

This page covers every screen between the sign-in form and the application, and what signing out does. Read it when you cannot sign in, or when you wonder what a sign-in step means.

Username

Every account has a username. A username has 3 to 64 characters: lowercase Latin letters, digits, dot, underscore and hyphen. It starts with a letter and is unique in the organization. Sign-in lowercases what you type, so Klaus and klaus are the same username.

Until you confirm your username, sign-in accepts your e-mail address as well. A banner at the top of the application asks you to confirm it: Confirm your username "<username>". Once confirmed, you sign in with it instead of your e-mail. The banner has the link Open account. After you confirm the username, only the username works at the sign-in form.

You confirm or change the username in the Login block of the profile, as described in Your Account. Choosing a different username asks for your current password.

The sign-in steps

Sign-in runs through up to three steps, in this order:

  1. The sign-in form, with Username and Password. The form also asks you to accept the terms, with a link to the Terms of Offer. Press Log in.

  2. The Two-step verification step, when the account has two-step verification.

  3. The Your password has expired step, when the password has expired.

The same steps run on the sign-in page that an application shows when it asks to connect to your account.

A wrong password

A failed sign-in shows the message Invalid username and/or password. The message is the same when the login does not exist, when the account is deactivated and when the password is wrong, so it tells nobody which of the three happened.

Too many attempts

After repeated failures the form shows Too many attempts. Try again in N min. The Log in button stays disabled until the wait ends. The rule behind the wait is described in Password Policy and Sign-In Protection.

The two-step verification step

When the account has two-step verification, the correct password leads to a step with the title Two-step verification. You set up and manage two-step verification as described in Two-Step Verification.

The field depends on the kind of code:

Field Code

Verification code

The 6-digit code sent to your e-mail address.

Authenticator code

The 6-digit code shown by your authenticator app.

Backup code

One of your backup codes.

Press Verify to finish the step. The links under the button change the kind of code:

Link What it does

Resend code or Resend code in <time>

Sends a new e-mail code. The previous code stops working.

Send a code to e-mail instead

Sends a code to your e-mail address when the step asks for an authenticator code.

Use a backup code

Switches the field to Backup code.

Use the code from the e-mail

Switches back to Verification code.

Use the code from the authenticator app

Switches back to Authenticator code.

Back to sign in

Returns to the sign-in form.

A wrong code, a code that was used before and a code that has expired all show the same message. For an e-mail code or a backup code it is The code is wrong or has expired. Enter it again, request a new code, or go back to sign in. For an authenticator code it is The code is wrong or has already been used. Enter the next code your app shows, or go back to sign in. After several wrong codes the step ends, and you start again from the sign-in form.

The expired password step

When your organization limits the age of passwords and yours has reached it, sign-in asks for a new password after the other steps. The step is titled Your password has expired and shows the notice For security, choose a new password before you continue.

  1. Enter the Current password.

  2. Enter the New password and repeat it in Repeat new password. The new password must meet the password policy.

  3. Press Change password and sign in.

The step stays open for a few minutes and ends after several wrong current passwords. A wrong current password, or a step that has ended, shows The current password is wrong, or this step has expired. Check the password, or go back to sign in and start again. The link Back to sign in returns to the sign-in form, and you start again from there.

A successful change ends the employee’s earlier sessions on every device. How passwords expire is described in Password Policy and Sign-In Protection.

Forgot password

  1. On the sign-in form, click Forgot password?

  2. The page titled Reset password asks Enter your username, with the hint Or your e-mail until you confirm a username. Enter it and press Reset password.

  3. The page answers If an account matches, a password reset link has been sent to <email>. The address is masked, for example k@e**.net.

The answer is the same for every username, so the page never shows whether an account exists.

A mail is sent only to an account that is active and belongs to an employee. The mail has the subject Change password and the text To enter a new password for the account <username>, follow the link <link>. The link works once and for one day. A newer request replaces the link, whether the employee or an administrator made it. Changing the password cancels an outstanding link.

The link opens the page New password for <username>.

  1. Enter the new password in Enter new password and again in Repeat new password.

  2. Press Save. The page confirms with Password successfully changed.

The new password must meet the password policy. Resetting the password ends every session of the employee and tells the connected applications, so you sign in again everywhere.

A link that has expired or has been used shows This link is no longer valid. Reset links expire after a while and can be used only once. The link Request a new link leads back to the Reset password page.

You can also request the link while signed in, from the profile, as described in Your Account.

Logging out

The icon next to your name in the header has the tooltip Log out. Logging out ends this session only. It also signs out the other open tabs of the same browser. Sessions on other devices stay open.

Logging out does not revoke the access that you gave to connected applications, and it leaves your personal access tokens and app passwords valid. Applications that registered a back-channel logout address are told that you signed out. You withdraw an application’s access with Revoke on the Authorizations tab, as described in Your Account.

To leave every device, press End all other sessions on the Sessions tab of your account, then log out.

Signed out by an application

A connected application can ask to sign you out of CityScreen Deals. Signing out from a connected application is part of the OAuth applications function. This function is licensed. If your organization’s license does not include it, contact CityScreen.

The page asks <application> asks to sign you out of CityScreen Deals, with two buttons. Sign out ends this session only and returns you to the application. Stay signed in takes you back into CityScreen Deals and changes nothing.

Other states of the page are You are signed out, This link has expired and The sign-out request cannot be completed. Administrators who connect applications find the technical side in Single Sign-On with OpenID Connect.

When you are signed out without asking

A session ends without your action in these cases:

  • the session duration of the organization has run out;

  • an administrator ended your sessions;

  • your password was reset or has expired;

  • you changed your password on another device;

  • your account was deactivated.

You sign in again to continue. The session duration is set by the organization, as described in Password Policy and Sign-In Protection.

Related pages