Login Security shows you who is signed in to PharmaERP right now, every sign-in attempt and the real reason a sign-in was refused. You can end a session that should not be open, see who is locked out, clear old sign-in history and check in the Access Matrix who may sign in from which office and at what times. Administrators who look after staff accounts use this page and so do people who review staff access before an audit.
The page does not change the settings on Members, Access Locations or Access Shifts. It shows their effect and the history. The message a person sees on the sign-in screen does not give the reason for a refusal. This is on purpose, so an outsider cannot learn how an account is set up. You look up the real reason here. For the person's side, see Signing in and I cannot sign in or cannot open a page.
1 Before you start
To do this | You need | Ask |
|---|---|---|
Open Login Security and the Access Matrix, filter the lists, open the evidence panel, preview a clean-up, download the matrix | AdminMember: View in Roles | Your administrator |
End (revoke) a session, expire a reset link, run a clean-up | AdminMember: Update as well | Your administrator |
Open a person from the Access Matrix (their name is a link to Members) | AdminMember: Update | Your administrator |
The same AdminMember right also opens the member list. Rights are read when you sign in. After a change in Roles, sign out and sign in again.
Nothing has to exist before you open the page. The lists fill themselves as people sign in and out. For the Access Matrix to show offices and hours, the offices must exist in Access Locations, the hours in Access Shifts and each person must be assigned to them on Members.
To find the page:
Sign in to PharmaERP.
Open System Settings in the left menu.
Under Security & Logs, click Login Security.
If Login Security is not in the menu, your role has no AdminMember: View. Opening the page by its address shows the Access Denied page. See Signing in.
For the matrix, click the blue Access Matrix button at the top of the page.
1.1 The screen at a glance
Area | What it is for |
|---|---|
Heading and Access Matrix button | Name of the page and the way to the matrix |
Four tiles | Online users, Failed attempts (last 24 hours), Active reset tokens, Expired active sessions |
Tab bar | Sessions, Login Attempts, Reset Tokens, History Cleanup. On the right: Live, the time of the last refresh, the auto-refresh choice and Refresh |
Filter bar | Narrow the open list with Search and Clear |
The list | One line per session, attempt or reset link, with a magnifier to see all details and, where allowed, a red action button |
Evidence panel | Slides in from the right and shows every recorded detail of one line |
2 Step by step
2.1 See who is signed in now
Open Login Security. The Sessions tab opens with Status set to Active and valid.
Read the list. Each line is one signed-in browser: the person, when they signed in, when PharmaERP last saw them (with "x min idle"), when the session ends if they do nothing and the internet address they came from.
To follow the list live, pick Every 30s or Every 60s in the box next to Refresh. The tiles and the open list then update while the page stays open.
The Online users tile and the total above the list show the same number. It counts sessions, so one person signed in from two browsers counts twice.
2.2 Find out why someone could not sign in
Click the Login Attempts tab.
Type the person's e-mail address in Search and choose Failed in Result. You can also set From and To to today. Click Search.
Look at the Failure Reason column of the newest line. The list is newest first.
Click the magnifier on that line. The evidence panel shows the reason, the office and shift the check compared against and an Explanation in plain words.
Fix the cause with the table in What each failure reason means, then ask the person to try again. Their next attempt appears at the top of the list.
The Explanation is filled in only for the office and hours refusals (IP_RESTRICTED, TIME_RESTRICTED, NO_PRIMARY_LOCATION). For the other reasons it stays empty. Matched Location and Matched Shift are empty when the internet address matched no office.
2.3 What each failure reason means
The person sees one of four messages on the sign-in screen. The Failure Reason column tells you which setting to change.
Failure Reason | What the person saw | What it means | How to fix it |
|---|---|---|---|
INVALID_PASSWORD | Invalid email or password. | The password was wrong or the e-mail or password was left empty. | Ask the person to try again with the right password. After 5 wrong passwords in a row the account is blocked, see Lock-outs. To give a new password, open the person in Members. |
UNKNOWN_USER | Invalid email or password. | No account has that e-mail address. | Check the spelling with the person. If they should have an account, create it in Members. |
INACTIVE_USER | Invalid email or password. | The account is switched off. | If the person should work in PharmaERP, switch the account on in Members. |
LOCKED_OUT | Too many failed login attempts. Please try again later or contact administrator. | The account is blocked after 5 wrong passwords. | Wait 15 minutes or set a new password in Members, which clears the block at once. |
IP_RESTRICTED | Unauthorised location | The person's internet address is not one of the addresses of their offices. | Open the person in Members and check their offices. Then check the office addresses in Access Locations. If the person works from home or travels, they cannot sign in until an office address matches or the office check is switched off on their record. |
TIME_RESTRICTED | Time period expired | The office matched, but the time of the attempt is outside the person's shift. | Check the shift hours in Access Shifts and which shift the person has in Members. The evidence panel shows Matched Location and Matched Shift. |
NO_PRIMARY_LOCATION | Unauthorised location | The office check is off, the hours check is on, the person has several offices and none is marked primary. | Open the person in Members and mark one office as primary. |
The three messages "Invalid email or password.", "Too many failed login attempts. Please try again later or contact administrator." and "Unauthorised location" / "Time period expired" are the only things the person sees. Three different reasons (wrong password, unknown e-mail, switched-off account) give the same message so that outsiders cannot guess which e-mails exist. Always look up the reason here.
2.4 Lock-outs
An account is blocked for 15 minutes after 5 wrong passwords in a row. While it is blocked, every sign-in attempt is refused with "Too many failed login attempts. Please try again later or contact administrator." and recorded as LOCKED_OUT. Attempts made during the block do not extend it.
To see who is locked out:
Click the Login Attempts tab.
Choose Failed in Result, type LOCKED_OUT in Search, set From and To to today and click Search.
Read the User / Email column. A person with a LOCKED_OUT line in the last 15 minutes is still blocked. To see the 5 wrong passwords that caused it, search the person's e-mail address instead and read the INVALID_PASSWORD lines just before.
To clear a lock-out:
Open the person in Members.
Set a new password and save. This clears the block at once.
Give the new password to the person in a safe way and ask them to sign in again.
If you do nothing, the person can sign in again after 15 minutes.
There is no Unlock button on Login Security. A new password in Members or one successful sign-in, are the only things that clear the wrong-password count. The end of the 15 minutes does not clear it. So the first wrong password after a block ends blocks the account for another 15 minutes. Tell the person to type the password carefully or set a new password for them.
2.5 End (revoke) a session
Use this when a laptop is lost, a colleague left a shared computer signed in or a session looks suspicious. You need AdminMember: Update.
On the Sessions tab, find the line. Search by name, e-mail, address or session number.
Click the red button with the no-entry sign at the end of the line. The button shows only on sessions still marked open.
Read the confirmation box and click Confirm revoke. Click Cancel to leave it.
The session is marked ended with the end reason FORCED and a SESSION_REVOKED line is added to Login Attempts under the name of the person whose session you ended, not under your name. The person's live screens, such as the PO Confirmation register and task bell, stop updating at once. Their password, role and profile do not change. You see the green message "Session revoked successfully." and the line changes to Ended.
What the person sees: at their next click PharmaERP sends them to the sign-in page. A screen that only loads data in the background stops with a "not signed in" answer. This can take up to about 2 minutes, so the person may keep working for a short time. They can sign in again at once with their normal password, because a revoke does not block the account. See Signing in.
A revoke does not stop the person from signing in again. For a lost or stolen laptop, also set a new password in Members or switch the account off there. A new password also signs out the person's old sessions, because they stop being valid at the next check, even though their lines on the Sessions tab keep showing as open.
2.6 Look at all the details of one line
Click the magnifier on any line of Sessions, Login Attempts or Reset Tokens.
The evidence panel slides in from the right with every recorded value.
Close it with the X or the Escape key.
2.7 Filter and search the lists
Open the tab you need.
Use Search for names, e-mail addresses, reasons, addresses or a record number. A part of a word is enough.
Use Status or Result, Client IP, From and To to narrow the list. To includes the whole day.
Click Search. Click Clear to empty the boxes.
Clear puts each box back to its first choice. On Sessions that is Active and valid, not All sessions. On Reset Tokens it is Active unused. If you expect to see ended sessions after Clear, choose All sessions again.
All dates and the From and To filters use UTC, not your local time. A sign-in just after midnight local time can fall on the day before or after.
2.8 Clean up old history
Do this only when the business has agreed how long to keep sign-in history. Old sign-in history can be audit evidence. You need AdminMember: Update.
Click the History Cleanup tab. PharmaERP counts what could be removed with the default periods (365, 90 and 30 days).
If the business has agreed other periods, change the days and click Preview Cleanup. The three cards show how many records would go.
Click Run Cleanup. PharmaERP counts again and shows a confirmation box with the numbers.
Click Delete eligible records to remove them or Cancel.
The records are deleted permanently. There is no undo. Sessions that are still marked open are never removed. The page does not record who ran the clean-up.
Run Cleanup stays grey until a preview found something to delete. If you change a day box, it turns grey again until you click Preview Cleanup.
2.9 Check who can sign in from where and when
Use the Access Matrix before an audit, after changing an office address or a shift or to make sure nobody is locked out by a wrong setting.
On Login Security, click Access Matrix.
Read the banners. A red one tells how many employees have a setting that stops them signing in, with Show only these. A blue one counts employees still on the old ("legacy") settings.
Narrow the list with Location, Shift, Status or Search name or email.
Read the Status column: OK, legacy or CANNOT SIGN IN followed by the reason or reasons.
Click Export CSV to download the same list, all pages, for the audit file.
For each CANNOT SIGN IN line, click the person's name (needs Update) or open the office or shift page and correct the setting.
The matrix lists only active staff accounts. A person is judged only when the office check or the hours check is switched on for them. The CANNOT SIGN IN reasons and where to fix them:
Reason in the matrix | What to do |
|---|---|
The office check is on, but the person has no office and no old address list | Assign an office to the person in Members |
The hours check is on, but the person has no office and no old hours | Assign an office and a shift in Members |
An assigned office is switched off | Switch the office on in Access Locations or assign another office in Members |
The office check is on and an office has no active internet address | Add an address to the office in Access Locations |
The hours check is on and an assignment has no shift or its shift is switched off | Choose an active shift in Members or switch the shift on in Access Shifts |
The hours check is on, the office check is off, the person has several offices and none is primary | Mark one office as primary in Members |
While old and new settings run side by side, the matrix and the real sign-in can disagree. The matrix may say CANNOT SIGN IN for a person who can still sign in through their old address list or hours and the other way round. When in doubt, look at the person's latest attempts on the Login Attempts tab.
Before using the Cannot sign in filter, choose 100 in records per page so every employee is on one page. If you ever chose 10, 20 or 50 on a list, the filter and the red banner look only at the employees on the page you see.
2.10 Reset links
The Reset Tokens tab is meant to list password-reset links and let you expire one that should not be used. PharmaERP does not send reset links in this version, so the tab is always empty and Active reset tokens is always 0.
If a person asks for a new password, set it for them in Members.
3 Messages you may see
3.1 On this page
Message | What it means | What to do |
|---|---|---|
Session revoked successfully. (green) | The session was ended | Nothing. The person is signed out at their next click, within about 2 minutes |
Current session cannot be revoked from this screen. Please use logout. | You tried to end your own session | Use sign out instead. See Signing in |
Invalid session selected. | The request carried no valid session | Reload the page and try again |
Session is already inactive. | The session had already ended, for example another administrator ended it | Click Refresh. Nothing more to do |
Session was not found. | The session line was removed, for example by a clean-up | Click Refresh |
Login attempt was not found. | The attempt was removed, for example by a clean-up | Click Refresh |
Reset token was not found. | The reset link was removed | Click Refresh |
Invalid reset token selected. | The request carried no valid reset link | Reload the page. The tab is empty in this version |
Used reset tokens cannot be expired. | The link was already used | Nothing to do |
Reset token is already expired. | The link had already expired | Nothing to do |
Reset token expired successfully. | The link no longer works | Nothing to do |
Evidence unavailable (in the evidence panel, with a yellow message) | The line you opened is gone | Close the panel and click Refresh |
Unable to load detail. (red) with "The selected record could not be loaded." | The details could not be read | Close the panel and try again. If the whole page fails, you may have been signed out. See Signing in |
Unknown detail type. | The panel could not tell which kind of line you opened | Reload the page and try again |
Unable to load security summary. (red) | The four tiles could not be read | Click Refresh. If it repeats, reload the page. You may have been signed out. See Signing in |
Unable to load purge preview. (red) | The clean-up counts could not be read. Run Cleanup stays grey | Open the History Cleanup tab again or click Preview Cleanup |
No eligible security history found for the selected retention days. | Run Cleanup found nothing to remove | Nothing to do or change the days and click Preview Cleanup |
Cleanup completed. Deleted N login attempts, N inactive sessions and N reset tokens. | The clean-up finished | Note the numbers for your records |
Cleanup failed. No partial cleanup was kept. Please try again or contact support. | An error stopped the clean-up and nothing was deleted | Try again later. If it repeats, send the time to support and check the Error Log |
Action completed. (yellow) | Your role has AdminMember: View but not Update. The action was refused and nothing changed. The message is misleading | Ask your administrator for AdminMember: Update in Roles, then sign out and in. Check the list to see that the line did not change |
Action failed. Please try again or contact support. | The request failed, for example the page was open too long or the connection dropped | Reload the page and try again. If it repeats, check the Error Log and tell support |
3.2 Access Matrix banners
Message | What it means | What to do |
|---|---|---|
N employee(s) have configurations that prevent them signing in. (red) | Some people on the list have a setting that will refuse them | Click Show only these and fix each line with the table under Check who can sign in from where and when |
N employees are still governed by the legacy IP and time fields. (blue) | These people have no office assignment. The old address list and hours on their record still apply | Assign offices and shifts in Members when you are ready to move them |
3.3 Refusals around this page
What you see | What it means | What to do |
|---|---|---|
The Access Denied page when you open Login Security or the Access Matrix | Your role has no AdminMember: View | Ask your administrator to tick it in Roles, then sign out and in. See Signing in |
The sign-in page appears while you work | Your session ended: you were idle for 30 minutes, signed out or an administrator ended it | Sign in again. See Signing in |
A list or the tiles stop updating or show an old state, with no message | A request failed or your session ended while the page stayed open | Click Refresh. If the sign-in page appears, sign in again |
A server error page | An unexpected error | Reload the page. If it repeats, tell support the time and check the Error Log |
3.4 On the sign-in screen (what the person sees)
Message | What it means | What to do |
|---|---|---|
Invalid email or password. | Wrong password, unknown e-mail or switched-off account | Find the line in Login Attempts and use What each failure reason means |
Too many failed login attempts. Please try again later or contact administrator. | The account is blocked for 15 minutes | See Lock-outs |
Unauthorised location | The internet address is not one of the person's offices or the person has several offices and none is primary | Look up the attempt. Fix it in Members or Access Locations |
Time period expired | The attempt was outside the person's shift | Look up the attempt. Fix it in Access Shifts or Members |
Password reset is not enabled yet. Please contact administrator. | The person used Forgot password, which does not work yet | Set a new password in Members |
4 Troubleshooting
4.1 If you are an administrator
4.1.1 A colleague says they cannot sign in
Open Login Attempts, search their e-mail address and choose Failed in Result.
If there is no line at all, the attempt never reached PharmaERP or the e-mail was typed differently. Search part of the name or search by today's date and Failed.
Open the newest line and note Failure Reason.
Fix the cause with What each failure reason means and ask the person to try again.
If the page still does not help, see I cannot sign in or cannot open a page.
4.1.2 A colleague says they were signed out suddenly
Open Sessions, choose Forced or revoked in Status and search their name.
A line with end reason FORCED means an administrator ended the session. The page does not show which administrator.
If there is none, look for LOGGED OUT (they signed out) or an old line that became Active but expired (they were idle for more than 30 minutes).
If an administrator set a new password for them in Members, their old sessions stop working at the next check, but still show as open here.
4.1.3 The sessions list is empty or shows the wrong people
Check Status. The default Active and valid hides ended and expired sessions.
Choose All sessions, empty Search, Client IP, From and To and click Search.
Remember that dates are UTC.
4.1.4 A person shows as online twice
The tile counts sessions, not people. The person is signed in from two browsers or two computers. End the one that should not be open.
4.1.5 The Revoke button does nothing or says "Action completed."
Ask your administrator to check that your role has AdminMember: Update in Roles.
Sign out and in, so the new right is read.
Revoke again and click Refresh to check that the line changed to Ended.
4.1.6 The Access Matrix shows nobody or fewer people than expected
Click Clear or set Location, Shift and Status back to all.
Only active accounts are listed. A switched-off account is not shown.
Choose 100 in records per page and reload the matrix.
4.2 If you are a user
4.2.1 I was signed out and I did not do anything
Sign in again.
If it happens every few minutes, tell your administrator. They can look for your sessions on this page.
See Signing in for the reasons a session ends.
4.2.2 I cannot open Login Security
Check that Login Security is under Security & Logs in System Settings.
If it is missing or you see Access Denied, ask your administrator for AdminMember: View in Roles, then sign out and in.
5 Good to know
Without AdminMember: Update the Revoke, Expire and Run Cleanup buttons still show, but the action is refused and a yellow "Action completed." appears. Check the list and ask for the Update right.
A revoke is not instant. The person can keep working for up to about 2 minutes. For a lost or stolen laptop, also change the password in Members.
The page does not record which administrator revoked a session or ran a clean-up. Keep your own note of date, time and reason if you need it for an audit.
A session ends 30 minutes after the person's last activity. A session that simply times out is never closed on this page, so Expired active sessions keeps growing. It is not a list of problems to act on and the clean-up does not remove these sessions.
A session you end shows as Ended with FORCED. A session the person ended shows as Logged out with LOGOUT. A session still marked open but unused for over 30 minutes shows as Expired.
Attempt type has seven choices, but only LOGIN, LOGOUT and SESSION_REVOKED ever contain lines. A search for the others returns nothing. The Location column and the country and provider fields in the evidence panel are always "-".
The Client IP shown is the address the server received. It can come from information sent by the person's computer, so treat it as a strong hint, not as proof, until IT confirms how the server is reached.
Everyone with AdminMember: View sees the sessions, e-mail addresses and internet addresses of all staff. Give the right only to people who manage staff accounts and keep downloaded matrix files safe.
Login Security only reads the settings. Change a person in Members, offices and their addresses in Access Locations, working hours in Access Shifts and what a person may open in Roles.
If something on this page fails with no clear message, look in the Error Log.