User Guide
/
15.3 · Admin and Security

Password Reset, Recovery Codes and Security Questions

TX1 supports three ways to recover access if a password is lost. Configure at least two per user for safety.

1. Password Reset via Email

Each PasswordResetToken is a one-time token mailed to the user's registered email.

Flow

  1. On the login screen, click Forgot Password.
  2. Enter username or email.
  3. TX1 generates a token and sends it.
  4. User clicks the link in the email, enters a new password.
  5. Token is consumed (single-use, expires after N hours).

The email integration requires SMTP to be configured in Admin → Email Settings. Without SMTP, this route is unavailable.

2. Security Questions

Each user can set up three UserSecurityQuestion answers.

Flow

  1. On login → Forgot Password → Use Security Questions.
  2. TX1 asks the user's three questions.
  3. Correct answers let the user reset their password on the spot.

Answers are hashed on save — TX1 admins cannot see them.

3. Recovery Codes

RecoveryCode is a batch of one-time codes generated for a user.

Flow

  1. Profile → Recovery Codes → Generate.
  2. TX1 generates 10 codes; user saves them offline.
  3. On login → Forgot Password → Use Recovery Code.
  4. Enter one code; it is consumed; user resets password.

Recovery codes don't require email; they are the offline safety net. Recommend every user has a current set.

Admin Reset

If all else fails, an admin can trigger a forced reset:

  1. Admin → Users → select user → Reset Password.
  2. TX1 generates a temporary password.
  3. User must change it on first login.

Account Lockout

After N failed attempts, an account is locked for a configurable time (default 10 minutes). Unlock via:

  • Wait for the timeout.
  • Admin → Users → Unlock Account.

Multi-Factor (MFA)

TX1's base install does not ship MFA in the box, but the identity model is designed to accommodate future TOTP / authenticator apps via an additional entity.

Best Practices

  • Enforce strong passwords via Admin → Security Policy.
  • Require security questions on account creation.
  • Require recovery code generation before enabling SSO (if applicable).
  • Don't share recovery codes between users — they bypass all normal controls.

Audit Trail

Every reset / recovery attempt (success or failure) is logged with:

  • Timestamp.
  • User.
  • Method (email / question / code).
  • Outcome.

Check Admin → Audit Log → Security Events after an incident.