Security Settings

Security settings help firm administrators control account protection, MFA, recovery codes, and enterprise SSO.

Who Can Manage Security

Only ADMIN and SUPER_ADMIN users can update firm security settings.

Multi-Factor Authentication

Use MFA to require an authenticator code during sign-in.

1. Open Settings > Security.
2. Start authenticator setup.
3. Scan the QR code or enter the setup secret in your authenticator app.
4. Enter the 6-digit code to finish setup.
5. Store the recovery codes securely. Recovery codes are shown once and are consumed after use.

If firm policy requires MFA and your account is not enrolled, password sign-in is blocked until MFA is configured by an administrator-supported flow.

Recovery Codes

Recovery codes are backup sign-in codes for TOTP MFA.

• Each code works once.
• Regenerating codes replaces all previous recovery codes.
• CaseSolo stores recovery codes as hashes, so support cannot recover the original codes.

Passkeys

Passkey enrollment is available as a security setting so firms can begin collecting approved WebAuthn credentials. Password-flow passkey sign-in requires the future WebAuthn assertion flow before it can replace TOTP for login enforcement.

Enterprise SSO

Enterprise firms can configure SAML or OIDC SSO.

• SAML requires an IdP login URL or metadata URL.
• OIDC requires an issuer URL and client ID.
• Client secrets are encrypted and are never displayed after saving.
• Enforced SSO blocks password login for matching email domains unless a user is explicitly listed as a bypass user.

Audit Trail

Security changes are written to the firm activity audit log, including MFA enrollment, MFA verification, recovery-code rotation, passkey registration, SSO configuration, and SSO enforcement changes.