You can configure the password policies for specific groups of users by using the password policy profile. You can create different profiles for different user groups so that the system applies the specified password policy to each user group for each profile. Based on the policy specified for users, Self Service Password Reset generates the text to display in the change password policy. To customize this text, use the Password Rule Text setting, which overwrites the Self Service Password Reset auto-generated text.
To configure password policy for a specific profile, do the following:
Log in to Self Service Password Reset at https://dns-name/sspr as an administrator.
In the toolbar, click your name.
Click Profiles > Password Policy Profiles > default.
(Conditional) If you want to create different profiles for a different set of users:
Click Edit List, then add the profile names to the list by using Add Profile.
In the Add Value field, enter the profile name.
The profile name must have the following format:
Start with a letter (a-Z)
Contain only letters, numbers, and hyphens
Length between 2 and 15 characters
You can include multiple profiles. During authentication, Self Service Password Reset searches for the default profile first, and then the other profiles in the order mentioned.
Select the appropriate profile name.
Self Service Password Reset does not allow changing the name of the profile.
Configure the following settings:
Specify the query that matches specific users for the specified profile. You can query by using Add Filter that includes the object class, and by using Add Group that includes the LDAP group.
Specify the minimum length of the password. Specify 0 to disable this feature.
Specify the maximum length of the password. Specify 0 to disable this feature.
Specify the maximum number of times a character can be repeated in the password. This is case-insensitive. Specify 0 to disable this feature.
Specify the maximum number of times a character can be repeated sequentially in the password. This is case-insensitive. Specify 0 to disable this feature
Select this option to allow numeric characters in the password.
Select this option to allow the first character of the password to be numeric. This setting is applicable when only numeric characters are allowed in the password.
Select this option to allow the last character of the password to be numeric. This setting is applicable only when numeric characters are allowed in the password.
Specify the maximum number of numeric characters you want to allow in the password. This setting is applicable when you allow numeric characters in the password. Specify 0 to disable this feature.
Specify the minimum number of numeric characters you want to allow in the password. This setting is applicable when you allow numeric characters in the password. Specify 0 to disable this feature.
Select this option to allow non-alphanumeric characters in the password.
Select this option to allow the non-alphanumeric character to be the first character of the password. This setting is applicable when you allow the special characters in the password.
Select this option to allow the non-alphanumeric character to be the last character of the password. This setting is applicable when you allow the special characters in the password.
Specify the maximum number of special characters allowed in the password. This setting is applicable when you allow the special characters in the password. Specify 0 to disable this feature.
Specify the minimum number of special characters required in the password. This setting is applicable when you allow the special characters in the password. Specify 0 to disable this feature.
Specify the maximum number of alphabetic characters allowed in the password. Specify 0 to disable this feature.
Specify the minimum number of alphabetic characters required in the password. Specify 0 to disable this feature.
Specify the maximum number of non-alphabetic characters allowed in the password. Specify 0 to disable this feature.
Specify the minimum number of non-alphabetic characters required in the password. Specify 0 to disable this feature.
Specify the maximum number of uppercase characters allowed in the password. Specify 0 to disable this feature.
Specify the minimum number of uppercase characters required in the password. Specify 0 to disable this feature.
Specify the maximum number of lowercase characters allowed in the password. Specify 0 to disable this feature.
Specify the minimum number of lowercase characters required in the password. Specify 0 to disable this feature.
Specify the minimum number of unique characters required in the password. Specify 0 to disable this feature.
Specify the maximum number characters that a user can reuse from the previous password in the new password. Specify 0 to disable this feature.
Specify the minimum amount of time that must pass between password changes. Value is in seconds. Specify 0 to disable this feature.
Select this check box to enable users to check the password against the configured word list.
Select the Microsoft Active Directory style password complexity rules from the list:
Select this setting to use the following password complexity rule:
Cannot contain the user's account name or parts of the user's full name that exceeds two consecutive characters
Contain at least six characters in length
Contain characters from three of the following four categories:
English uppercase characters (A through Z)
English lowercase characters (a through z)
Base 10 digits (0 through 9)
Non-alphabetic characters (for example, !, $, #, %)
Select this setting to use the following password complexity rule:
Cannot contain the user's account name or parts of the user's full name that exceeds two consecutive characters
Minimum 6 characters
Maximum 512 characters
Must contain following category of characters. You specify the exact number of categories by setting the Policies > Password Policies > [profile] > Active Directory 2008 Password Complexity Maximum Violations option.
European language uppercase alphabetic characters
European language lowercase alphabetic characters of Base 10 digits (0 through 9)
Non-alphabetic characters (for example, !, $, #, %)
Other alphabetic characters not included in the other categories
Select this setting if you do not require any of the Active Directory password complexity rule.
NOTE:Self Service Password Reset considers the password policy that is a combination of Self Service Password Reset and Active Directory complexity. Hence, the change password page displays the policies that are a combination of Self Service Password Reset and Active Directory complexity.
If you require the exact policy of Active Directory complexity, then ensure to make changes to minimum and maximum character specifications in Self Service Password Reset policy settings as specified in the Active Directory complexity.
Specify the maximum number of Active Directory 2008 Level Complexity category violations that is allowed for users.
This setting is applicable if the Active Directory Password Complexity setting is set to Active Directory2008 Level Complexity.
Add a Regular Expression pattern the password must match in order to be allowed. Multiple patterns can be listed. A pattern must match the entire password to be applied. The system ignores a partial match. You can use Macros.
Specify a Regular Expression pattern the password must not match in order to be allowed. Multiple patterns can be listed. A pattern must match the entire password to be applied. The system ignores a partial match. You can use Macros.
Specify the list of case-insensitive values that you do not want to allow in the password. For example, password, user name, and the name of the organization.
Specify the list of attributes not allowed to be used as passwords. For a given user, the system reads the values and does not permit it to be used as part of the password value. This check is case-insensitive.
NOTE:Specifying a number after the attribute name restricts how many consecutive characters in the value are disallowed. For example, Language:4 means the password cannot contain: Engl, ngli, glis, or lish, for English speaking users.
Specify the minimum password strength level required. 45 to 69 are good and above 69 are strong. A value of 0 disables this check.
Specify the maximum amount of characters in a sequence such as 0123456789 or abcdefghijk. You can define a more specific character sequence by a Unicode character order of each character after the entire value is converted to lowercase. To disable this check set the value to 0.
Specify the message to be displayed to the user during password changes. You can include HTML tags in messages.
NOTE:A change password message read as part of an LDAP password policy might overwrite this setting.
When blank, the system displays an automatically generated rule list to the user. The automated rule list might not be inclusive of all settings in the password policy. Some of the more esoteric or difficult to communicate rules do not appear in the automatically generated list. This is done in an attempt to not overwhelm the user with having to read and parse the rules before attempting to change the password. Should the user type a password that conflicts with such a rule - the per-keystroke rule checker provides direct feedback to the user on how to correct the problem.
To override the automatically generated rule list, set a value in this option. The option permits HTML tags.
Prohibits the current password from being used as the new password.
NOTE:This can only be enforced if the login method permits the user's password to be known.
Specify the minimum number of defined character groups users must have in their passwords.
Define a character group that users must have in their password. A character group is a regular expression of patterns. For example, the following two character groups of:
[a-zA-Z]+ [0-9]+
Requires that the users have a letter or a number in their passwords.
Click Save changes.