How admin invitations and sessions work

MapleGather’s admin invitations are designed around a one-time emailed link, so new admins never receive a password in email — and session controls give your organization the right balance between convenience and security. In this version an invitation is only recorded: no invitation email is sent and an invitation can’t be accepted.

The short version

When you invite someone as an admin, MapleGather records the invitation and lists it as Pending. In this version that is all that happens: no email or link is sent, and the invitee’s account never becomes active from the invitation. Sessions stay live based on your organization’s configured session lifetime, and sensitive actions prompt a quick re-authentication check before they proceed.

How it works

Invitation lifecycle

When you record an invitation, MapleGather stores it with the invitee’s name and email and shows it on the Pending invitations tab. It does not generate a link or send an email, and the Initial role you chose is not stored with it. Accepting an invitation isn’t available: a password submitted on an invitation page is refused with “This invitation can’t be accepted. Accepting admin invitations isn’t available in this version, so setting a password here never completes.”

The intended design, once built: MapleGather emails the invitee a single-use link valid for 30 days, the invitee sets a password that meets your organization’s password policy, and their account is activated, with no plaintext credentials in the email.

Invitation states move in one direction:

Pending → Accepted (when the invitee completes setup — not possible in this version, so an invitation stays Pending)

Nothing in this version moves an invitation to Expired or Revoked, and cancelling a pending invitation isn’t available from the Pending invitations tab.

Re-sending invitations

Re-sending an invitation isn’t available in this version. The Pending invitations tab (on the Admins page, /admin/admin-security/admins) lists each invitation with its name, email and Pending status, but has no resend or cancel option, and a new invitation to the same email address is refused while the earlier one is still pending. See Invitation link expired or already used.

Session lifetime

MapleGather supports two session modes:

Remember me (default 14 days) — suitable for personal devices where the admin is the only user.
Workstation session (default 8 hours) — suitable for shared or public devices. The session ends automatically after 8 hours.

Both lifetimes are configurable under your organization’s password policy. See Configure password policy and session settings for the full options.

Re-authentication for sensitive actions

Certain high-impact actions require a recent sign-in: MapleGather refuses them when your last sign-in is more than five minutes old, however long the session has been active. On most of those screens a prompt then offers Confirm identity, which sends you to sign in again (you’re asked for your password there, never inside MapleGather) and brings you back. The DPA signing form has no such prompt yet: it shows “You don’t have permission to do that.”, and you sign out and back in yourself (see Sign the DPA).

Actions that trigger re-authentication include:

Changing a password
Adding or replacing a payment method
Granting admin access to another member

Why it works this way

Token-based invitations mean the inviting admin never has to create or share a temporary password. This prevents credential sharing and puts each admin in control of their own login from day one. Re-authentication checkpoints add a targeted layer of security for the actions with the broadest organizational impact without requiring a full sign-out and sign-in.

Edge cases & boundaries

No invitation link is issued in this version, so there is no link to use, re-use or revoke.
Multi-factor authentication enrollment is planned for a future release and will extend the re-authentication model.