Security Settings

Athena's sign-in behavior is governed by a small set of security settings you control from Settings → Security: how long a session and its token stay valid, when an account locks after repeated failed logins, and the password policy your users' passwords must satisfy. This page explains each setting, its default and allowed range, how it is enforced, and how to read or change it from the console, the REST API, and PowerShell.

Where to find it#

Open Settings → Security in the console. The tab groups the settings into three sections, each with its own Save action:

• Session — token expiration and session idle timeout.
• Lockout — maximum failed login attempts and lockout duration.
• Password Policy — minimum length and character-class requirements.

Values you set here are stored in the server's configuration and read back the next time each rule is evaluated, so changes take effect without restarting the server. Every change is written to the audit trail.

Session & token expiration#

Two independent controls decide how long a signed-in operator stays authenticated.

The idle timeout is interactive: about a minute before it fires, the console shows a countdown dialog with Stay logged in and Log out now buttons, so a user who is still at their desk can extend the session with a click. Any keyboard or mouse activity resets the idle timer. When the timeout is reached the console clears the session and returns to the sign-in page.

Account lockout#

To slow down password-guessing, Athena counts failed sign-ins per account and temporarily locks the account once the threshold is reached.

These two settings work alongside the server's built-in brute-force protections — a progressive delay that grows with each failed attempt, a per-IP request-rate limit, and a higher hard-lock threshold for repeated lockouts that requires a manual unlock. Those extra protections are covered on the Emergency Recovery page.

Password policy#

The Password Policy section defines the complexity rules for local passwords — the passwords you set when creating a user or resetting one. Directory (LDAP / Active Directory) and SSO (Keycloak) users authenticate against your identity provider and are unaffected by this policy; see LDAP / Active Directory and Authentication & SSO.

REST API#

The same settings are available over the JWT-authenticated REST API on port 8443. Send the bearer token as Authorization: Bearer <token>; both endpoints require the Admin role.

# Read current security settings
curl -k -H "Authorization: Bearer <token>" \
  https://athena.example.com:8443/api/settings/security

# Update: 30-minute idle timeout, lock after 3 failures for 30 minutes,
# and require a special character in passwords
curl -k -X PUT -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "tokenExpirationMinutes": 15,
    "sessionTimeoutMinutes": 30,
    "maxFailedLoginAttempts": 3,
    "lockoutDurationMinutes": 30,
    "passwordPolicy": {
      "minimumLength": 12,
      "requireUppercase": true,
      "requireLowercase": true,
      "requireDigit": true,
      "requireSpecialCharacter": true
    }
  }' \
  https://athena.example.com:8443/api/settings/security

Values are clamped to their allowed ranges on save (for example, Session Timeout to 0–1440 and Password Minimum Length to 6–128), so an out-of-range value is corrected rather than rejected.

PowerShell#

The Athena PowerShell module reads and writes the security settings with Get-AthenaSettings and Set-AthenaSettings using the Security category. Sign in with Connect-Athena as an Admin first.

# Connect as an Admin
Connect-Athena -Server "athena.contoso.com"

# Read the current security settings
$security = Get-AthenaSettings -Category Security
$security.SessionTimeoutMinutes
$security.PasswordPolicy

# Tighten the idle timeout and lockout, then save
$security.SessionTimeoutMinutes = 15
$security.MaxFailedLoginAttempts = 3
$security.LockoutDurationMinutes = 30
Set-AthenaSettings -Category Security -Settings $security

# Require a special character in local passwords
$security.PasswordPolicy.RequireSpecialCharacter = $true
Set-AthenaSettings -Category Security -Settings $security

Set-AthenaSettings supports -WhatIf/-Confirm, so you can preview a change or gate it in a script.

Auditing#

Every change to the security settings is written to the audit trail as a Security settings change, recording the acting user, their IP address, and which values changed — for example a change to Token Expiration, Min Password Length, or Require Special Character. This gives you a complete record of who adjusted the sign-in policy and when.

Related#

• Roles & Permissions — the roles that govern who can sign in and who can change these settings.
• User Accounts — create local users and reset passwords.
• Emergency Recovery — break-glass unlock and password reset from the server host, plus the built-in brute-force protections.
• Authentication & SSO and LDAP / Active Directory — external sign-in providers, which manage their own password policies.
• Configuration — where these settings live in the server configuration.