About password policies

Password Policies Are Checked Against Recommended Minimums

When an administrator edits a group's advanced password settings, the application checks the following recommendations:

• Minimum password length: 12

• Minimum special characters: 1

• Minimum numeric digits: 1

• Minimum alphabetical characters: 1

• Minimum uppercase characters: 1

• Minimum lowercase characters: 1

• Case-sensitive passwords: Enabled

• Where applicable, account lockout recommendations are also considered when a user is assigned to a group.

The default values are automatically applied when a new application is created. These settings represent security recommendations and do not prevent the configuration from being saved.

Auto Logoff/Lockup

When an administrator edits a group's advanced Auto Logoff/Lockup settings, the application displays a warning message if Account Auto Lockup Enable is disabled and/or Lock up account after is not configured. These settings may increase the risk of unauthorized access through repeated login attempts. The user must acknowledge the warning message before continuing.

Weak Policy Warnings Identify Specific Problems

A warning message lists each setting that falls below the recommended value. For example:

• Minimum password length is below the recommended value (12).

• Minimum number of special characters is below the recommended value (1).

• Minimum number of numeric digits is below the recommended value (1).

• Minimum number of alphabetical characters is below the recommended value (1).

• Minimum number of uppercase characters is below the recommended value (1).

• Minimum number of lowercase characters is below the recommended value (1).

• Case-sensitive passwords are disabled.

When a weak setting is detected, the user receives a warning asking whether to save the value anyway.

• Selecting Yes saves the weak policy.

• Selecting No cancels the change and restores the previously saved values.

• The default selection is No, helping to prevent accidental acceptance of a weak policy.

Importing Security Systems from Another Application

When importing security systems from another application, a warning message is displayed informing the user that some imported users may have been created with passwords that do not meet the application's default recommended password policies. This is an informational message only; no passwords are changed during the import process.

If the user selects OK, the users are imported into the application. If the user selects Cancel, the import process is aborted.

Weak Group Policies Can Be Reported When Assigning Users

When a user is assigned to a group whose policy is determined by tag or expression values, the application evaluates the resulting effective policy and checks whether it falls below the recommended security level. If any policy settings are below the recommended minimum, the administrator is presented with a warning identifying the affected policies. The administrator may still proceed with the assignment after acknowledging the warning, in which case the user is successfully added to the group.

Before creating the user account, the application validates the user's password against the effective password policy. The account is created only if the password complies with all required policy settings. Otherwise, the administrator is prompted to update the password so that it meets the policy requirements.