Policy Server Guides › Policy Design Guide › Password Services Dialog Reference › Password Policy Dialog › Password Policy Dialog Fields and Controls › Password Policy Dialog—Restrictions Tab › Dictionary Group Box

Dictionary Group Box

The Dictionary group box is where you can configure the password policy to check passwords against a user-defined dictionary of forbidden passwords.

The Policy Server dictionary file is a list of strings that cannot be used in passwords. You can include common passwords such as SECRET or words commonly used in the users’ industry. For example, a bank may disallow words like Account, Savings, Checking, and Money. Strings in the dictionary may not be embedded in a password.

Note: The dictionary file must be located in a directory that all Policy Servers can access.

Note: The last line of the dictionary file used by Password Services must be followed by a carriage return or it will not be included in the dictionary search.

Path field

Specifies the full path and name of the dictionary file.

Match Length

Controls the length of strings compared against values in the dictionary file. The comparison ignores the case (upper/lower) of the strings. If the Match Length field is left blank or set to zero, only passwords that match a string in the dictionary exactly will be rejected. If the match length is greater than zero, passwords entries will be rejected if both of the following are true:

• The password includes a substring which starts with the same series of characters as a dictionary entry.
• The number of consecutive matching characters are greater than or equal to the number specified in the Match Length field.

For example, consider a dictionary file that contains the following:

• lion
• tiger
• bear

If the Match Length field is set to 4, the following will result:

• "TeddyBear" will be rejected because Bear matches the bear entry in the dictionary file.
• "prestige" will be rejected because tige matches the first four characters of the tiger entry in the dictionary file.
• "Geiger Counter" will be accepted since iger does not include the first letter of the tiger entry in the dictionary file.