Policy Server Guides › Policy Server Configuration Guide › Password Policies › Create Password Policies

Create Password Policies

You create a password policy to provide an additional layer of security to protected resources.

To create a password policy object

1. Click Policies, Password.
2. Click Password Policy, Create Password Policy.

   The Create Password Policy pane opens.

   Note: Click Help for descriptions of settings and controls, including their respective requirements and limits.

3. Enter the policy name.
4. Select the user directory to which the policy applies from the Directory list.
5. Specify if the policy applies to the entire directory or part of the directory.

   Note: If the policy only applies to part of the directory, click Lookup to specify the part of the directory that the policy is to apply.

6. Specify the redirection URL in the Redirection URL field:
   • To use the Password Services CGI, specify the following:

     http://<server.company.org>/siteminderagent/pwcgi/smpwservicescgi.exe
     

     Note: The default Password Services CGI path sometimes differs when you set up a custom Password Services directory. The Password Services CGI is deprecated.

   • To use the Password Services FCC, specify the following:

     http://<server.company.org>/siteminderagent/forms/smpwservices.fcc
     

     Note: The Password Services FCC is the default redirection URL. For more information about the Password Services FCC, see the Web Agent Configuration Guide.

   • To use the Password Services servlet, specify the following:

     http://<server.company.org>/siteminderagent/pwservlet/PSWDChangeServlet
     

7. Configure the policy to reflect the password logic you want by configuring expiration, composition, expression, restriction, or advanced settings.

Configure Password Expiration

You configure password expiration settings to define events, that when triggered, the Policy Server disables the user account and optionally redirects the user to a new Web page. Examples of such events include multiple failed login attempts and account inactivity.

Note: Expiration settings are optional. If you do not want to enable an expiration setting, leave the respective fields blank.

To configure password expiration

1. Click the Expiration tab.

   Password expiration settings open.

   Note: Click Help for descriptions of settings and controls, including their respective requirements and limits.

2. Specify user login tracking settings by selecting the Track successful logins, Track failed logins, and Authenticate on Login Tracking Failure check boxes in the Expiration group box.

   Note: You must select the Track successful logins check box if you want to disable accounts based on account inactivity. You must select the Track failed logins check box if you want to disable accounts based on failed login attempts.

3. Specify the settings that determine how often a password must be changed in the Password expires if not changed group box.
4. Specify the settings that determine how many incorrect password attempts are permitted in the Incorrect Password group box.
5. Specify the settings that determine how long a password can remain inactive in Password expires from inactivity group box.

   Note: If you do not need to configure passwords to expire from inactivity, we recommended that you do not set this option for performance reasons.

6. Click Submit to save the password policy or click another tab to continue working with the password policy.

Configure Password Composition

You configure password composition rules to control the character composition of newly created passwords.

Note: Composition rules are optional. If you do not want to enable a composition rule, leave the respective fields blank.

To configure password composition restrictions

1. Click the Composition tab.

   Password composition settings open.

   Note: Click Help for descriptions of settings and controls, including their respective requirements and limits.

2. Enter the minimum and maximum character length for passwords in the Minimum Length and Maximum Length fields.
3. Enter the maximum number of characters that can appear consecutively in a password in the Maximum field.
4. Specify the permissible characters types and the minimum requirements for each in the Content Minimum group box.

   Note: If you are using Netscape 4.1 Directory Server with Password Services, do not specify a non-printable characters minimum. Netscape 4.1 Directory Server does not accept non-printable characters.

5. Click Submit to save the password policy or click another tab to continue working with the password policy.

Password Regular Expressions

Regular expression matching for passwords allows you to specify text patterns used for string matching that each password must match or not match to be considered valid.

For example, if you require the first character in the password be a digit but not be the last character, you can configure a regular expression to enforce this requirement and all passwords will be checked against it.

Regular Expressions Syntax

The following table describes the characters you can use for constructing regular expressions for password matching. This syntax is consistent with the regular expression syntax supported for resource matching when specifying realms.

All closure operators (+, *, ?) are greedy by default, meaning that they match as many elements of the string as possible without causing the overall match to fail. If you want a closure to be reluctant (non-greedy), follow it with a ’?’. A reluctant closure matches as few elements of the string as possible when finding matches.

The regular expression syntax is a s follows:

Limit: Each regular expression can contain no more than 10 subexpressions, including the expression itself. The number of subexpressions equals the number of left or opening parentheses in the regular expression plus one more left parenthesis for the expression itself.

Configure Regular Expression Matching

You configure regular expressions to specify text patterns that are used for string matching. A password must match or not match the expression to be valid. Each regular expression entry is a name/value pair consisting of a descriptive tag and expression definition.

Regular expression matching for passwords is optional. If you decide to use regular expression, you only specify entries for expressions that passwords must match or must not match. If you have no expression matching requirements, do not create any regular expression entries.

To configure regular expressions for passwords

1. In the Password Policy dialog, select the Regular Expressions tab.

   You will see an empty table in the Regular Expressions group box.

2. Click Add to add an expression.

   The Password Regular Expression dialog opens.

3. Select one of the following radio buttons:
   • MUST Match

     If you select this option, define a regular expression that passwords must match.

   • MUST NOT Match

     If you select this option, add an entry for each regular expression that passwords must not match.

4. Enter values for the fields.

   Note: Click Help for descriptions of settings and controls, including their respective requirements and limits.

5. Click OK.

   The regular expression is added to the table. If you selected MUST NOT match, you will see a checkbox in the NO Match column.

Configure Password Restrictions

You configure password restrictions to place restrictions on password usage. Restrictions include:

• how long a user must wait before reusing a password
• how different the password must be from ones previously used

You can also prevent users from specifying words that you determine are a security risk or contain users’ personal information.

Note: Restrictions are optional. If you do not want to enable a restriction, leave the respective fields blank.

To configure password restrictions

1. Click the Restrictions tab.

   Password restriction settings open.

   Note: Click Help for descriptions of settings and controls, including their respective requirements and limits.

2. Specify how much time must pass and/or how many new passwords must be created before an old password can be reused in the Reuse group box.

   Note: If you specify both criteria, each must be satisfied before a user can reuse a password.

   Example: A password policy requires users to wait 365 days and specify 12 passwords before reusing a password. After a year, if a user only supplied six passwords, the user would have to supply another six passwords before reusing the first password.

3. Specify how much a new password must differ from the previous password in the Changed Required group box.
4. Specify the number of consecutive characters the password policy compares to personal information stored in user profiles in the Profile Attributes group box.
5. Specify the path to a user-defined dictionary of forbidden passwords and the length of the string compared against values in the dictionary in the Dictionary group box.
6. Click Apply to save the changes or click OK to save the changes and return to the Administrative UI.

Configure Advanced Password Options

You configure advanced password policy options to specify that submitted passwords be pre-processed before validation and storage. Advanced password policies let you assign a priority to a policy, which allows the predictable evaluation of multiple password policies that apply to the same user directory or namespace.

Note: Pre-processing options are optional. You should specify a unique password policy evaluation priority for each password policy that may be assigned to the user directory or namespace.

To configure advanced password options

1. Click the Advanced tab.

   Advanced password policy settings open.

   Note: Click Help for descriptions of settings and controls, including their respective requirements and limits.

2. Specify options to process submitted passwords prior to evaluation and storage in the Password Pre-Processing group box.

   Note: You should specify identical pre-processing options for each password policy that is applied to the same user directory or namespace.

3. (Optional) If the password policy is one of multiple policies that applies to the same user directory or namespace, specify a the password policy priority in the Password Policy Priority group box.

   Note: Evaluation priorities range from 0-999, where 999 is the highest.