Password policy

A password policy brings together rules on creating and updating passwords for pool users.

Password policy settingsPassword policy settings

Users with an administrator or organization owner account have access to password policy settings.

Password complexityPassword complexity

There are two available password complexity options:

• Any character types: Minimum length depends on the number of character types used in a password. For example, for a password made up of lowercase and uppercase letters, you can set the length of 14 characters, and for a more complex one, 10 characters.

  This is the preferred option because it does not require particular characters and allows users to create passwords that are stronger yet easier to remember.

• Required character types: Password must contain all specified character types and meet the required length. You can specify the following types of characters:

  • Lowercase letters
  • Uppercase letters
  • Numbers
  • Special characters, e.g., !@#$%^&*

Password uniquenessPassword uniqueness

Password uniqueness settings spell out additional requirements for passwords when they are created or changed.

The following settings are available:

• Password check: If the user tries to set such a password, the system will reject it. Such passwords are easily guessed by attackers.
• Password history: Number of the user’s most recent passwords that cannot be reused. For example, if set to 5, the user will not be able to set a password matching any of the last 5 passwords used. The minimum value is 1; the maximum is 10. The default value is 1 (only the current password cannot be reused).

Password lifetimePassword lifetime

Password lifetime is the period of time after which users will have to update their passwords. You can specify a lifetime of up to 730 days or set no limit.

Protection against password guessingProtection against password guessing

To configure protection against password guessing, you can use the following settings:

• Number of failed password attempts before lockout: From 1 to 100.
• Failed attempt interval in minutes or seconds.
• Lockout duration in minutes or seconds.

Default password policyDefault password policy

When you create a user pool, it is assigned the following default password policy:

• Minimum password length for character types used in the password:
  • 4 types: 10
  • 3 types: 11
  • 2 types: 24
• Minimum password lifetime: Unlimited.
• Maximum password lifetime: 365 days.
• Password check against the database of common passwords is on.
• The number of recent passwords that cannot be reused: 1.
• Number of wrong password entries before lockout: 15.
• Interval for counting wrong entries: 10 minutes.
• Lockout duration: 10 minutes.