Users, MFA and single sign-on

Who can sign in to NeverLapse, and how.

Users

Settings > Users. Everyone listed has the same full access: certificates, hosts, credentials, settings and other users. There are no roles.

  • Add a user: their email and a first password (8+ characters with upper case, lower case, a number and a symbol; Generate Random makes one). They must change it at first sign-in: after signing in with it, they get a Choose a new password dialog that can't be closed (the only other button is Sign out). The new password must meet the same rules; saving it opens the dashboard (or MFA setup first, if MFA is required). The same happens after you reset someone's password. With single sign-on set up, leave the password blank for someone who will only use SSO; they never see this dialog.
  • Reset password, Reset MFA (lost phone) and Delete are in each user's menu.
  • Break-glass: marks an account that may still use a password when single sign-on is required (see below).
  • The list shows each account's state: Must change password, Locked out, MFA on/No MFA, SSO only, Break-glass.

Forgot your password? Forgot password on the sign-in page emails a reset link (needs Email set up). Your own password: account menu (top right) > Change password.

Two-factor authentication (authenticator app)

  1. Account menu (top right) > Two-factor authentication.
  2. Scan the QR code with Microsoft Authenticator (+ > Other account), Google Authenticator, Authy or 1Password, and type the 6-digit code.
  3. Save the 10 recovery codes it shows somewhere safe. Each works once if you lose your phone.
  • From then on every password sign-in asks for a code. Don't ask again on this computer skips it in that browser for 14 days.
  • New phone: Move to a new phone on the same page.
  • Lost phone and no recovery codes: another user clicks Reset MFA (lost phone) for you under Users; you set it up again at your next sign-in.
  • Codes depend on the phone's clock. If every code is rejected, make sure the phone sets its time automatically.
  • Require an authenticator app (Settings > Sign-in & security): anyone who signs in with a password and has none is sent to set it up before they can do anything else.

Single sign-on (SAML)

Let people sign in with your company's identity provider (Microsoft Entra ID, Okta, Google Workspace, ADFS, JumpCloud, OneLogin or any SAML 2.0 provider), including its own MFA and conditional access. People are matched to NeverLapse users by email address.

Open NeverLapse through the address your users will use (for example https://certs.yourcompany.com) before copying the values below: they're built from the address in your browser.

On Settings > Sign-in & security:

  1. Give your identity provider these details: the Identifier (Entity ID), Reply URL (Assertion Consumer Service) and Sign-on URL, or our metadata URL. The Name ID / user identifier must be the user's email.
  2. Your identity provider's details: paste its metadata URL and click Load, or paste the metadata XML and click Load from XML.
  3. Options, then Save sign-in settings:
    • Turn on single sign-on: adds the sign-in button.
    • Create a NeverLapse user automatically: off (default) = only people already under Users can sign in; on = anyone your identity provider lets through gets an account. Control who that is by assigning users or groups to the app at your identity provider.
    • Require single sign-on: hides the password form, except for break-glass accounts. If none is marked, yours is marked automatically.
    • Sign-in button text, Email attribute (if your provider sends the email in an attribute instead of the Name ID) and Our Entity ID override (advanced).
  4. Click Test single sign-on in a new tab and make sure it works before turning on Require single sign-on.

Microsoft Entra ID

  1. Entra admin center > Enterprise applications > New application > Create your own application. Name it NeverLapse and choose Integrate any other application you don't find in the gallery.
  2. Single sign-on > SAML > Basic SAML Configuration: Identifier (Entity ID) and Reply URL from NeverLapse.
  3. Attributes & Claims: set Unique User Identifier (Name ID) to user.mail (or user.userprincipalname if that's the email your users are added with).
  4. Copy the App Federation Metadata Url (SAML Certificates section) into NeverLapse and click Load.
  5. Users and groups: assign who may use NeverLapse.

Okta

Applications > Create App Integration > SAML 2.0. Single sign-on URL = NeverLapse's Reply URL; Audience URI (SP Entity ID) = NeverLapse's Identifier; Name ID format = EmailAddress; Application username = Email. Copy the Metadata URL from the Sign On tab into NeverLapse and click Load. Assign people or groups.

Google Workspace

Admin console > Apps > Web and mobile apps > Add custom SAML app. Copy or download the identity provider metadata and paste it into NeverLapse's XML box. ACS URL = Reply URL; Entity ID = Identifier; Name ID format = EMAIL; Name ID = Basic Information > Primary email. Turn the app on for the right organizational units.

When your identity provider changes its certificate

The identity provider's signing certificate is checked on every sign-in. When it rotates the certificate, click Load again on the Sign-in & security page (the metadata URL is remembered).

Keep at least one break-glass account with an authenticator app, so an outage at your identity provider can't lock everyone out.
Previous Every setting explained NextUpdates (install from inside the app)