Signing in

Overview

Omaya has three ways in. Which one a person uses depends on their work in the building, not on seniority. The first two are web pages on the host that runs the organisation's Omaya; nothing has to be installed.

Three doors, two kinds of account. Administrators use the admin console; the people who only use an app — cleaners, receptionists, guards — have an app user account and sign in at their organisation's own page. The phone app takes either. northwind stands for your organisation's tenant ID.

User	Account type	Sign-in address	Typical users
A person who sets the platform up or reads its reports	An administrator, created under System > Admins	/admin/login	Facilities manager, operations lead
A person who only uses an app: cleaning rounds, reception, guard tours	An app user, created under Apps > App Users	/<organisation>/login, for example /northwind/login	Cleaners, receptionist, guards
Either of the above, on a phone	The account the person already has	The Omaya Mobile app	Technician

The two account types are separate. An administrator's username and password do not open /northwind/login, and an app user's do not open /admin/login. If one person needs both, an administrator can import their admin account as an app user from the App Users page; the person then has two accounts.

Where this chapter shows northwind, use the organisation's tenant ID: the short code, usually one lower-case word, issued with the account.

Signing in to the admin console

Applicable versions / plans

SPECIFICATION

• Account: an administrator created under System > Admins (permission create-admins, held by the shipped Admin and Manager roles).
• Two-factor authentication is mandatory for every administrator who signs in with a password. An authenticator app that produces six-digit time-based codes is required (Google Authenticator, Microsoft Authenticator, 1Password, Authy or similar).
• Not applicable to app users or to the Omaya Mobile app.

Requirements

At Northwind Tower, Ravi Kumar has created an administrator account for Aisha Rahman under System > Admins and given her the tenant ID northwind, her username and a first password. Aisha now signs in for the first time.

• Sign in to the admin console with the tenant ID, username and first password.
• Set up two-factor authentication on her phone.
• Replace the first password with one of her own.

Restrictions

• Tenant ID is the organisation's short code, not the company's full name. One Omaya installation serves many organisations, each with its own database, so the form must identify the organisation before it can look up the account.
• Username is the user's own username, not an email address.
• Five wrong passwords for one username from the same network within one minute lock further attempts for that username for the time shown. After five failures Omaya also emails a security alert to the platform's security contact, if one is set.
• New password: at least 8 characters, with upper- and lower-case letters, a number and a symbol, and different from the current password.
• There is no Remember me box; see Session rules.
• No other page opens until two-factor authentication is set up.

Configuration roadmap

(1) Sign in with the tenant ID, username and password.

(2) Set up two-factor authentication with an authenticator app.

(3) Choose a new password.

Procedure

1. Open /admin/login and set the fields as follows.

   Configuration Item	Value	Note
   Tenant ID	northwind	The organisation's short code.
   Username	aisha.rahman	The user's own username, not an email address.
   Password	(first password)	The eye button shows the typed text.

2. Click Sign In. Omaya opens Two-Factor Setup with the note MFA is mandatory for all admin accounts.

3. Open the authenticator app on the phone and scan the QR code. If the camera cannot scan it, Can't scan? Enter this key manually shows a key to type in instead.

4. Type the six-digit code the app shows in Authentication Code and click Activate Two-Factor Auth. The code confirms that the phone's clock and Omaya's agree.

5. Because the first password was chosen by another administrator, Omaya opens Password Change Required. Set Current Password, New Password and Confirm New Password, and save.

NOTE

The authenticator app lists the entry under the host name, the tenant ID and the username, so a person with accounts in two organisations can tell them apart. Sign out instead on the setup page signs the user out without completing the setup.

NOTE

A link with the tenant ID already filled in avoids the most common mistake by new colleagues; see Pre-filled sign-in links.

Verification

• The dashboard opens.
• A wrong setup code shows Invalid code. Please check your authenticator app and try again.
• A wrong tenant ID, username or password shows Invalid username or password. Omaya does not say which field is wrong.

Subsequent sign-ins

Two-factor is not optional for administrators. The only times Omaya does not ask for a code are a quick continue from a remembered account card used in the last six hours, and single sign-on, where your identity provider has done that job. App users on /<organisation>/login and the phone app are not asked for a code.

After the password, Omaya asks for the current six-digit code on Two-Factor Authentication (Authentication Code, then Verify). There are two exceptions: a quick continue from a remembered account card (see Remembered accounts and quick continue), and single sign-on.

Every 90 days Omaya opens the change-password page before any other page. This applies to sign-ins with a password; a sign-in through single sign-on does not use the Omaya password, so the change is not requested. The password can also be changed at any time from the account menu at the top right: Change Password.

Remembered accounts and quick continue

Characteristics

After a successful sign-in in a browser, the login page shows a card for the account on the next visit: the person's name, the organisation and username, and when the account was last used. Up to three accounts are remembered per browser, for 30 days.

Element	Function
Continue	Shows the person's name and asks only for the password.
Not you? Choose another	Returns to the list of cards.
× (Remove this account)	Removes the card from this browser. The account is not affected.
Use a different account	Shows the full form with Tenant ID and Username.

The cards are stored in a cookie in that browser only. They are a convenience, not a session: the password is required every time.

Quick continue

Quick continue skips the two-factor code, not the password. When a user signs in from a card and the account was active within the last six hours, Omaya does not ask for the two-factor code that time. Two-factor authentication stays enabled for the account. A sign-in typed into the full form always asks for the code.

NOTE

Six hours is the default. The platform operator can change it.

Pre-filled sign-in links

Link	Function
/admin/login?tenant=northwind	Opens the form with Tenant ID filled in and the note Signing in to northwind. The remembered-account cards are skipped.
/admin/login?tenant=northwind&sso=1	Skips the form and goes straight to the organisation's identity provider. Use it once single sign-on is set up.

Both links, with the organisation's own tenant ID, are shown ready to copy on the single sign-on settings page: Login link for your organisation and Direct single sign-on link. Include them in the onboarding email or on the intranet.

Session rules

Rule	Message	Reason
30 minutes without activity signs the user out.	Your session expired due to inactivity. Please sign in again.	A console left open on a shared desk.
One session per account. A sign-in elsewhere ends the first session.	Your session was terminated because the account was signed in from another device.	Prevents two people sharing one login. Give each person their own account.
Deactivated accounts are signed out at their next click.	Your account has been deactivated. Please contact your administrator.	An administrator switched the account off.
Passwords expire after 90 days.	The change-password page, after a password sign-in	Policy. Single sign-on does not use the Omaya password, so it is not requested.

There is no Remember me for administrators. Its only function would be to sign a user back in after the session has ended, and each rule above ends a session deliberately: an idle console, a second device, a deactivated account. Each browser session also keeps its own two-factor check. A browser that still holds a remember cookie from before 4 October 2026 is not signed in by it.

Single sign-on (SSO)

When the organisation has set up single sign-on, administrators can sign in with their company account (Microsoft Entra ID, Okta, Google Workspace, or any other OpenID Connect provider) instead of an Omaya password.

Signing in with single sign-on

1. On the login page, click Sign in with single sign-on below the form.
   • If Tenant ID contains the organisation, or a remembered card was chosen, the browser goes straight to the identity provider.
   • If Tenant ID is empty, Omaya asks Enter your work email address (or your organisation ID). A work email works when its domain has been routed to the organisation (see below). The tenant ID always works.
2. Sign in at the identity provider. The dashboard opens.

Omaya does not ask for its own two-factor code after SSO, and does not open Two-Factor Setup or the change-password page: the identity provider decides how strongly to check the person, so set the MFA policy there. This also applies to an account that SSO created automatically. If the same account later signs in with a password, the password rules apply to that sign-in: two-factor setup and the 90-day change.

Email-domain routing

Email-domain routing is set up by the platform operator, not by the organisation. Once @northwind.example is routed to Northwind, anyone signing in with SSO can type their work email and never needs the tenant ID. The SSO settings page shows the domains routed to the organisation under SSO domain routing.

Configuring single sign-on

Applicable versions / plans

SPECIFICATION

• Menu: System > Configuration, Single sign-on card (/admin/config/sso).
• Permission: manage-settings-general (Manage General Settings). The shipped Admin role has it; the Manager role does not, because single sign-on decides how every administrator signs in.
• Identity provider: Microsoft Entra ID (Azure AD), Okta, Google Workspace, or any provider that publishes /.well-known/openid-configuration under its issuer URL.

Requirements

At Northwind Tower, Aisha Rahman wants every administrator to sign in with their Microsoft Entra ID work account, so that leavers are removed in one place.

• Administrators sign in with their work account instead of an Omaya password.
• New administrators from the facilities group get an account automatically.
• Passwords are refused once everyone has moved across.

Restrictions

• Issuer URL: required, must start with https://, at most 255 characters.
• Client ID: required, at most 255 characters.
• Scopes must include email, which is how Omaya matches the person to an account. openid is added automatically if missing.
• Roles from identity-provider groups: at most 50 mappings. A mapping cannot give a role with a permission the editing administrator does not hold.
• Make single sign-on the only way in is unavailable until at least one SSO sign-in has succeeded.

Configuration roadmap

(1) Register a web app with the identity provider, using the callback URL shown on the page.

(2) Enter the provider details and test the issuer.

(3) Decide who may sign in and which role they receive.

(4) Enable single sign-on, save, and test it in a private window.

Procedure

1. Choose System > Configuration and click the Single sign-on card.

2. At the identity provider, register a web app with the Callback / redirect URI shown on the page as its redirect URI. Grant openid, profile and email.

3. Set the fields as follows.

   Configuration Item	Value	Note
   Identity provider	Microsoft Entra ID (Azure AD)	Fills in an example issuer and a hint for the provider. Other choices: Okta, Google Workspace, Other OpenID Connect.
   Login button label	(empty)	Default Sign in with SSO, at most 60 characters. Shown on the login page when it is opened with the organisation's login link (Login link for your organisation, further down the same page); the plain login page reads Sign in with single sign-on.
   Issuer URL	https://login.microsoftonline.com/<directory>/v2.0	Click Test beside it to fetch the provider's discovery document.
   Client ID	(from the provider)	—
   Client secret	(from the provider)	Leave blank to keep the stored secret.
   Scopes	openid profile email	Default.
   Allowed email domains	northwind.example	Comma-separated. Empty accepts any account the provider signs in.
   Create an admin account automatically on first sign-in	On	Without it, only people who already have an admin account here, with the same email address, can use SSO.
   Default role for new accounts	Viewer	Role given to automatically created accounts that match no group.
   Groups claim	groups	Under Roles from identity-provider groups (optional). Default groups; Entra ID can also send roles.
   Re-apply on every sign-in	On	Moves a person's role in Omaya when they move group at the provider.
   Group mappings (Add mapping)	Omaya-Facilities → Manager	Group name, object ID or app role and Omaya role. The first matching group wins.
   Enable single sign-on	On	—
   Make single sign-on the only way in (refuse passwords for this organisation)	Off	See SSO-only sign-in.

4. Click Save.

5. In a private browser window, sign in with Sign in with single sign-on before announcing it to anyone else.

Verification

• Test shows Discovery document found.; a wrong issuer shows Discovery failed: followed by the reason.
• Save shows Single sign-on settings saved.; a rejected value shows Could not save: followed by the reason.
• The test sign-in in the private window opens the dashboard, and the page shows the time of the last successful SSO sign-in.

SSO-only sign-in

Make single sign-on the only way in (refuse passwords for this organisation) turns off password sign-in for the organisation. A password sign-in is then answered with This organisation signs in with single sign-on. Use the "Sign in with single sign-on" link below. The check is made before the password is examined, so a leaked password cannot be used.

The option is unavailable until someone has signed in with SSO successfully at least once, so a wrong setting cannot lock everyone out. Platform operators are never affected by it.

CAUTION

Turn it on once every administrator has moved to SSO. A password that still works can still be phished.

Two-factor authentication

Characteristics

• Two-factor authentication is mandatory for every administrator who signs in with a password. It is set up at the first sign-in (see Signing in to the admin console). Until it is set up, every admin page returns to Two-Factor Setup.
• After single sign-on, the identity provider is the second factor.
• It is not used for the app-user sign-in or in the Omaya Mobile app.
• Wrong codes are answered with Invalid authentication code. Please try again. After five wrong codes Omaya shows Too many incorrect codes. Please sign in again. and the sign-in starts again from the password.

CAUTION

A phone clock that is a minute out produces codes that Omaya rejects. Set the phone's clock to automatic, and read the entry for the right organisation.

Resetting two-step sign-in after a lost phone

There is no self-service route, by design. An administrator with the edit-admins permission (shipped Admin and Manager roles) resets it:

1. Choose System > Admins.
2. Find the person's row (type part of the name in Find a person) and click Reset two-step sign-in on the row, or click the row and click Reset two-step in the panel that opens. The button is shown only when two-step sign-in is set up for that person.
3. In Reset two-step sign-in? (Their current authenticator stops working, and they set it up again the next time they sign in.), press and hold Reset.

The console shows MFA has been reset. The administrator will be asked to re-enroll on next login. The person's next sign-in goes through Two-Factor Setup again, exactly like a new account. Every reset is recorded in the Activity Log.

Forgotten passwords (admin console)

1. On the login page, click Forgot Password?
2. Set Tenant ID and Username, and click Send Reset Link.
3. Omaya emails a link to the email address on the admin account. The link works once, for 60 minutes. A new request replaces the earlier link.
4. Open the link and choose a new password: at least 8 characters, with upper- and lower-case letters, a number and a symbol. Then sign in.

The page always answers If that account exists and has an email address on file, a reset link has been sent., whether or not the account exists, and also when the email could not be sent, so that nobody can use it to find out who has an account. A failed email is written to the platform log for the platform operator. A successful reset shows Your password has been reset. You may now sign in.

NOTE

If no email arrives, the usual cause is an account without an email address. Ask an administrator to add one, or to set a new password under System > Admins.

App users

Staff who only use an app sign in at /<organisation>/login; for Northwind Tower, /northwind/login. The page shows the organisation's name and logo and Sign in to your workspace. The language buttons at the top (EN, MS, 中文) and the light/dark button work before signing in.

SPECIFICATION

• Account: an app user created under Apps > App Users with at least one app granted. An account with no apps granted cannot sign in.
• Two-factor authentication is not used for app users.

Signing in with a password

1. Set Email and Password.
2. On a personal phone or computer, tick Keep me signed in.
3. Click Sign in.

If the account has been used in this browser before, it is shown as a card with Last signed in … under it. Tap the card and type only the password. × (Remove this account) removes the card from this browser, Use another account shows the empty form, and Back to accounts returns to the cards. As on the admin console, the card fills in the email address and nothing else.

Signing in with a one-time link

For people who sign in rarely and do not remember a password, a link can sign them in without one. The link works once, for 15 minutes.

Started by	Method
The app user, on the sign-in page	Open Or sign in with a one-time link, type the Email and click Send sign-in link. The link arrives by email.
An administrator	Under Apps > App Users, select the user and click Copy sign-in link: the link is copied to the administrator's clipboard, to send by WhatsApp, text message or on paper. Or click Email sign-in link to email it to the user; the email names the administrator who sent it.

The sign-in page always answers If that email belongs to an active account here, a sign-in link is on its way. It works for 15 minutes., so that nobody can use it to find out who works there. If nothing arrives, the account may be switched off or have no apps granted; ask the administrator.

Forgotten password

1. On the sign-in page, click Forgot password?. Forgot your password? opens at /<organisation>/password/email.
2. Type the email address and click Send reset link.
3. Open the emailed link within 60 minutes and choose a new password of at least 8 characters.

The browser returns to the sign-in page with Password reset. You can now log in.

Temporary password set by an administrator

An administrator can set a password for an app user under Apps > App Users with Set temp password (at least 8 characters). At the next sign-in, Omaya opens Choose your own password, and no other page opens until it is done:

1. Type the temporary password in Current password.
2. Type the new password twice (at least 8 characters, different from the current one).
3. Click Save password.

App user home page

After signing in, /<organisation>/ shows the apps granted to the user, and nothing else. The password can be changed later from the profile (Account > Change password), and Sign out is there too. The apps section describes each app from the user's point of view.

Omaya Mobile

Omaya Mobile signs in with the Tenant ID, an email address or username and a password, and accepts either an administrator or an app-user account. It does not ask for a two-factor code. Installation, sign-in and the app's own error messages are described in Getting started.

Landing page and visible menu

Administrators land on the dashboard. Two of its tiles are easy to misread; read that chapter before relying on its numbers. From there the side rail holds the whole platform: Navigating the console describes the page lists, search and the account menu, and the menu reference describes every item.

The menu differs from one user to another. This is the most common question after a new colleague's first day:

• Nearly every page needs a permission. The role decides which items appear. If a colleague can see a page that another cannot, compare their roles under System > Roles before assuming a fault.
• A role can be limited to some people and assets. Entity access under System > Roles can limit a role to the people and assets that carry chosen labels. A user in that role sees only those on the Entity page, the Entity Tracker, Right Now and the dashboard's Entities tile, so their counts are lower. Reports are not limited this way.
• Some pages belong to apps. If an app is not enabled for the organisation, its pages are not in the menu. That is a licence matter, not a fault.
• The SYSOP menu belongs to the platform operator. Nothing in it is needed to run an organisation's own site.

Multiple organisations and platform operation

More than one organisation. If an account may open several organisations, a Switch Tenant button (a shop-front icon) appears in the top bar. It lists the organisations the user may open; after one is chosen, every page reads that organisation. Check which organisation is open before concluding that a number is wrong.

Platform operators sign in with their own operator account; the Switch Tenant list then shows every active organisation. Each switch is recorded in the platform's own audit trail. Inside an organisation, an operator can also act as one of its administrators with Impersonate under System > Admins, on the person's row or in the panel that a row click opens. Another operator, or a switched-off account, cannot be impersonated. Stop Impersonating in the top bar ends it.

Signing out

Where	Method
Admin console	Account menu at the top right, Logout. The login page opens with You have been successfully logout.
App users	Profile, Sign out.
Omaya Mobile	See Getting started.

CAUTION

On a shared computer, sign out rather than closing the tab. Closing the tab does not end the session, and the remembered-account card stays until its × is clicked.

Sign-in messages

Admin console messages

Message	Cause	Action
Invalid username or password.	The tenant ID, username or password is wrong. Omaya does not say which, by design.	Check the tenant ID first; it is the field most often wrong. The username is not the email address.
Too many login attempts. Please try again in N seconds.	Five wrong passwords for that username from the same network within one minute.	Wait the time shown; further attempts do not help. Omaya has also emailed a security alert to the platform's security contact, if one is set.
This organisation signs in with single sign-on. …	The organisation is SSO-only.	Use Sign in with single sign-on.
Invalid authentication code. Please try again.	Wrong or expired two-factor code.	Use the newest code, from the entry for this organisation; set the phone's clock to automatic.
Too many incorrect codes. Please sign in again.	Five wrong codes.	Start again from the password. If no code ever works, ask an administrator to reset two-step sign-in (see Two-factor authentication).
MFA session expired. Please login again.	The two-factor page was left open too long.	Sign in again.
Your session expired due to inactivity. Please sign in again.	30 minutes idle.	Sign in again.
Your session was terminated because the account was signed in from another device.	The account signed in elsewhere.	If that was not the account holder, change the password and inform an administrator.
Your account has been deactivated. Please contact your administrator.	The account is switched off.	Contact an administrator.
This password reset link has expired. Please request a new one.	Older than 60 minutes.	Request a new link.
This password reset link is invalid.	Already used, or replaced by a newer request.	Use the newest email, or request again.
Session expired. Please refresh your browser and try again. (ERR: CSRF token)	The login page was open a long time before Sign In was clicked.	Reload the page and sign in.

Single sign-on messages

These are shown in red above the form.

Message	Action
No organisation is registered for @domain. …	The email domain is not routed. Type the tenant ID instead.
Unknown organisation ID.	Check the tenant ID.
Single sign-on is not enabled for this organisation.	Sign in with a password, or ask an administrator to finish the SSO setup.
No admin account for you@… in this organisation. Ask an administrator to create one.	Automatic account creation is off. An administrator must create the account under System > Admins with exactly that email address.
Your account (…) is not in a domain this organisation allows.	The provider sign-in used a different account, or the domain is not in Allowed email domains.
Your account is disabled. Contact your administrator.	The Omaya account is switched off.
The sign-in session expired. Try again. / Sign-in state mismatch. Try again.	Too long was spent at the provider, or the back button was used. Start again from the login page.
The identity provider returned: …	The provider refused. The text after the colon is the provider's own reason, for the IT team.

App user messages

Message	Cause	Action
Invalid credentials.	The email or password is wrong, or the account is switched off.	Check both. If they are correct, ask the administrator whether the account is active.
No app access has been granted to your account. Contact your administrator.	The account exists but has no apps.	The administrator grants apps under Apps > App Users.
Too many attempts. Please try again in N seconds.	Five failed sign-ins for that email from the same network within one minute; a colleague's mistakes on the same Wi-Fi do not count. It is also shown to everyone on a network that has had 50 failed sign-ins in ten minutes, across all accounts.	Wait the time shown.
Too many requests. Please try again in N seconds.	Five sign-in links requested from the same network within five minutes.	Wait, then check the inbox and spam folder for the links already sent.
The email could not be sent right now. Ask your administrator for a link instead.	Email delivery failed.	Ask an administrator to Copy sign-in link.
Invalid or expired link. Please request a new one.	The one-time link was already used or is older than 15 minutes.	Request a new one. Each link works once.
User account is no longer active.	The account was switched off after the link was created.	Contact the administrator.
That is not your current password.	On the change-password page.	Type the password used to sign in, or the temporary one.

Troubleshooting

The tenant ID is unknown. Ask the person who created the account, or read the address of the organisation's staff sign-in page: in /northwind/login it is northwind. A remembered-account card on the login page also shows it.

An app user cannot sign in at /admin/login. This is expected: app users sign in at /<organisation>/login. An app-user account is not an administrator account.

After SSO, Two-Factor Setup or a current password is requested. A sign-in through SSO goes straight to the dashboard, including for an account that SSO created. The sign-in was most likely made with a password rather than Sign in with single sign-on.

A colleague has left. Under System > Admins, turn off the On switch on their row (Administrator deactivated.) or delete the account; for app users, use Apps > App Users. An administrator who is signed in is signed out at their next click. With SSO, also remove the person at the identity provider.

Two-factor authentication cannot be turned off for one person. This is by design. Reset two-step under System > Admins clears it, and the person sets it up again at the next sign-in. The No two-step sign-in tile on that page counts the active accounts that have none set up.

Omaya Mobile rejects a password that works on the web. Check the tenant ID in the app, then see Getting started.