Difference between revisions of "Password Policy"

From SmartWiki
Jump to: navigation, search
(→‎Settings)
 
(32 intermediate revisions by 3 users not shown)
Line 1: Line 1:
−
__TOC__
 
−
 
−
 
−
 
 
==Overview==
 
==Overview==
−
'''Password Policy''' is used to configure the Password Policies within SmartSimple with your organizational policies. It is best practice to ensure that these policies match the other systems that are deployed by your organization. Consequently these policies provide for extensive configuration options.
+
'''Password Policy '''is used to configure the password policies within [[SmartSimple]] with your organizational standards. It is best practice to ensure that these policies match the other systems deployed by your organization; consequently, these policies allow for extensive configuration options. 
  
−
Password Policies include the ability to control; the length and complexity of passwords, password expiration and frequency usage, the method for sending new requested passwords, word restrictions, the number of retries allowed, the lockout time for the account if they exceed the number of retries, email alerts for invalid passwords.
+
'''Password Policies include the following:'''
  
−
'''Multiple password policies''' can be supported by the system. This feature provides for less stringent policies for types of users that infrequently access the system such as external contacts. Alternative password policies can be set for any level in the organizational hierarchy.
+
* The ability to control the length and complexity of passwords
 +
* The password expiration time period 
 +
* The password frequency usage 
 +
* The method for sending new requested passwords (via Email Templates) 
 +
* Word restrictions 
 +
* The number of retries allowed
 +
* The lockout time for the account if they exceed retry quota 
 +
* Email alerts for invalid passwords 
  
−
There can also be individual Password policies for the different companies in your organizations hierarchy. However, they will only be able to edit the policy and not the Activation Emails. These emails can only be configured from [[Global Settings|Global settings]].
+
Multiple password policies can be supported by the system. This feature provides for less stringent policies for types of users that ''infrequently ''access the system - for example, [[External]] contacts who would only use the system for an application. Alternative password policies can be set for any level in the [[Organization hierarchy|organization hierarchy]]. 
  
 +
You can also set individual password policies for the different companies of your organization hierarchy. However, they will be able to ''edit ''the policy only, and not edit the [[Email#Email Templates for User Activation and Password|the Activation Emails]], which can only be configured from [[Global Settings]] by a [[User|user]] with [[Global User Administrator|System Administrator]] [[User Role|privileges]]. 
  
 +
: '''Note: '''In all cases of password policies, '''common words '''or '''known common passwords '''are ineligible to be used as [[SmartSimple]] passwords. 
 +
==Configuration - Essentials==
 +
===How to Access the Password Settings===
 +
1. Click on the 9-square menu icon on the top right of your page.
  
−
==Settings==
+
:: {{Icon-Menu}} 
−
===Password Encryption===
+
2. Under the heading '''Configuration, '''select '''[[Global Settings]]. '''
−
{{PasswordEncryption}}
 
  
 +
3. Click on the tab labelled '''Security.'''
  
 +
4. Click on the hyperlink called '''Password and Activation Policies.'''
  
−
===Persistent Login and Expiration of Inactive Accounts===
+
A page displayed with numerous settings and tabs related to your system's password and activation policies will appear. On this page, you can modify the required complexities of passwords, email templates for activating users and setting passwords, disable inactive accounts, and more. 
−
[[image:password 001.png|border]]
 
  
−
'''Persistent Login''' provides for the use use of a persistent secure cookie on the users computer to eliminate the need to use a username and password to log into the system. '''This feature will be deprecated in the July 2016 upgrade.'''
+
:: [[File:General password activation policies.png|900px|border]] 
−
'''Disable Inactive Accounts''' provides the ability to automatically disable a user account after a predetermined period of time. A password reset is required by the user to regain access to the system. The main options are:
+
{| class="wikitable"
 +
|-
 +
||'''Tab Name'''
 +
||'''Overview of Features and Functionality'''
 +
|-
 +
||'''[[Password Policy#Password Settings|General]]'''
 +
||Provides access to modify, configure, or enable/disable general password settings, the deactivation of inactive accounts, activation settings, password reset messages, and persistent login.
 +
|-
 +
||'''[[Email#Email Templates for User Activation and Password|Activation Email Templates]]'''
 +
||Allows modification and configuration of Email Templates for the following functions: New User, Request Password, and Password Change Notification. Can also set a default language and From Address. 
 +
|-
 +
||'''[[Password Policy#Intruder Lockout Settings and Intruder Email Alert|Intruder Alert Settings]]'''
 +
||Allows modification of intruder settings, including the amount of retries, the lockout duration, and the content for an email alert when there is an intrusion.
 +
|-
 +
||'''[[Login Page#Invalid Login Audit|Invalid Login Audit]]'''
 +
||Provides a [[List View Overview|list]] of invalid logins by username, IP Address, and time for auditing and record-keeping purposes.
 +
|-
 +
||'''[[Password Policy#View Locked Users|Locked Users]]'''
 +
||Provides a list of locked users by name, Lockout Time, and the feature to directly set that user with a new password. 
 +
|-
 +
||'''[[Disable User Account After Inactive Period|Disabled Inactive Users]]'''
 +
||Provides a list of disabled, inactive users by name and date of disabling. 
 +
|}
 +
===Password Encryption===
 +
For your information, if necessary: 
  
−
* '''Disable user accounts after ''[X]'' days''' - The number of days a user account is inactive before it is disabled. Leave this field blank to disable this feature.
+
{{PasswordEncryption}}
−
* '''Apply Policy to All Sub-Companies''' - Click button to force-update the password policy of the current company and all sub-companies. '''Note:'''This is applicable when an organization has a root company and a one or more sub-companies each with it's own password policies.
 
−
* '''Disabled Inactive Account Message''' - The text to be displayed to a user trying to access an expired account.
 
  
−
===Password Settings Section===
+
===Password Settings===
−
This section is used to set password attributes
+
This section, under the first tab of the '''Password and Activation Policies '''labelled '''General, '''is used to set password attributes. 
  
−
[[image:password-002.png]]
+
:: [[File:General password settings.png|400px|border]]
 +
{| class="wikitable"
 +
|-
 +
||'''Password Length'''
 +
||The minimum length allowed for a password; the number inputted must be between '''6 - 32 characters.'''
 +
|-
 +
||'''Complexity'''
 +
||
 +
Set the level of character-type complexity required for a password. The options are as follows: 
  
−
'''Maximum Password Update in 24 Hours''' – Sets the maximum number of password changes a user can make within a 24 hour period can be defined. This is to prevent users bypassing the password history restriction by changing their password repeatedly to return to a previously used password. This setting only pertains to password changes by use of "Update Password" by user, not to the "Forgot Password" link or system administrators using "Set Password."
+
* '''No Restriction - '''any character can be used; this is the default. 
 +
* '''Alpha Only - '''only letters are able to be used.
 +
* '''Alpha & Numeric - '''both letters and numbers must be used in the password.
 +
* '''Alpha & Numeric & Special Characters - '''a combination of letters, numbers, and special characters must be used. 
 +
* '''Custom Policy - '''a password policy can be custom-defined. 
  
−
'''Password length''' – the minimum length allowed for a [[Password|password]], between '''6 and 32 characters'''.
+
'''Disable Restriction of Common Passwords - '''Toggling on this function will then ''enable ''the user's ability to use common passwords as their password. This is not recommended for security reasons, as common passwords are easier to guess and to enable security breaches. 
  
−
'''Data Restrictions''' - passwords set by users can be restricted so values such as first name, last name or organization name cannot be used in the password. Any number of fields can be selected from both the organization or the user profile; standard and custom fields are supported.
+
|-
 +
||'''Force Password Change'''
 +
||
 +
'''Force New Password on First Login - '''This will ensure that each individual user will be forced to change their password from a system-generated or SysAdmin-determined password into one of their own accord. 
  
−
[[image:password-008.png]]
+
* '''Note: '''This first login does not count towards the Maximum Password Update in 24 Hours setting. 
  
−
In the example above City, Country and Phone fields have been selected from the user's organization record and first name, last name, birthplace and nickname fields have been selected from the user profile.
 
  
 +
'''Expire All Passwords Now - '''This is a handy button that will immediately invalidate all passwords in the system, ensuring that each user will have to reset their passwords when they next log in. A good use-case of this function might be if you updated your password policy to require more complex passwords; by expiring all passwords, every user in your system will have to create new passwords that fall under the new password criteria. 
  
 +
|-
 +
||'''Password Expiration'''
 +
||Each user will be forced to change their password once the selected number of days has passed. Doing so every quarter or so is good security practice; however, any number of days can be set. On each login, the system will check how many days until the password expires and will notify the user their password is about to expire in X days.
 +
|-
 +
||'''Password History Check'''
 +
||You can set the number of previous passports (to a maximum of 32) that the system will remember for each user. When changing their password, users will not be permitted to re-use a previous password that is remembered by the '''Password History '''until the specified number of unique passwords have been used. 
 +
|-
 +
||'''Maximum Password Changes in 24 Hours'''
 +
||
 +
This will set the maximum number of password changes any individual user is able to make within a 24-hour period. This is to prevent users from bypassing the password history restriction by changing their password repeatedly in order to return to a previously used password.
  
−
====Password Complexity====
+
* This setting only pertains to password changes by use of '''Update Password '''by the user - it is not relevant to the '''Forgot Password '''link nor to the [[Global User Administrator|System Administrators]] ability to '''Set Password '''for users. 
−
'''Complexity''' – the level of complexity required in the [[Password|password]], the options are:
 
  
−
* '''No Restriction''' – any character can be used. This is the default.
+
|-
−
* '''Alpha Only''' – only letters can be used.
+
||'''Password Data Restriction'''
−
* '''Alpha & Numeric''' – letters and numbers must be used in the password.
+
||
−
* '''Alpha & Numeric & Special characters''' – letters, numbers and special characters must be used.
+
Configuring this setting will restrict password settings so that values such as first name, last name, or organization name ''cannot ''be used in the password. Any number of fields can be selected from both the '''Organization '''or the '''Contact '''[[Profile]]. 
−
* '''Custom Policy''' - a password policy can be custom defined.
 
  
−
====Custom Policy====
+
'''Organization Field '''- Both [[Standard Fields|standard]] and [[Custom Fields|custom fields]] are supported. 
−
* The '''Compose Custom Password Policy''' table provides the ability to define the custom password policy that matches your organization's security standards and provides control of each character type desired (upper case, lower case, numeric and/or symbols). You can also specify the minimum number of characters required for that character type.
 
−
* The character mask used to define your selection will appear in the '''Custom Password Policy''' field. You can also write your own code and paste it into this field if desired.
 
−
* The '''Validate Pattern''' button will open a window where you can test various passwords against the policy to see if they will pass or fail.
 
−
* The value in the '''Custom Password Policy Description''' field will be displayed to users when setting/changing their password. You can use plain text or html in this field (For example, to insert a line break use ''<br>'')
 
−
* '''Note''': See also [[Custom Password Policy Examples]]
 
−
[[Image:Custpwpolicy.png]]
 
  
−
'''Important:''' When defining a custom password policy be sure to provide a detailed description of the policy in the '''Custom Password Policy Description''' field so that users are aware of the minimum requirement to enable them to create a valid password.
+
'''Contact Field '''- Both [[Standard Fields|standard]] and [[Custom Fields|custom fields]] are supported. 
  
−
If you need to translate the '''Custom Password Policy Description''' message you can use [[sslogic]]. It is often easiest to use [[System Variables]] for these. Example:
+
|}
 +
====Disable Inactive Accounts and Activation Settings====
 +
Scrolling down further on the '''General '''password settings page will bring you to the sections that allow you to set the criteria for disabling and activating accounts. 
  
−
<pre style="white-space: -o-pre-wrap; word-wrap: break-word;">&lt;!--@sslogic('@langid@'='2')-->&lt;br>@system.Password Policy - French@&lt;!--@else-->&lt;br>@system.Password Policy@&lt;!--@end--></pre>
+
[[User]] accounts can be configured to automatically become disabled after a predetermined period of inactivity. Once disabled, a [[Password Policy#Password Reset Message|password reset]] is required by the user to regain access to the system. This feature adds to the many user management options within the system.
  
 +
:: [[File:Password disable and activate.png|500px|border]]
 +
{| class="wikitable"
 +
|-
 +
||'''Disable user accounts after ''X ''days'''
 +
||Insert the number of days a user account is inactive before it is disabled. In order to disable this feature, simply leave the field blank.
 +
|-
 +
||'''Apply Policy to All Sub-Companies'''
 +
||
 +
Click this button to force-update the password policy related to the current organization and all sub-companies. 
  
−
===New Password Settings===
+
'''Note: '''This is applicable when an organization has a [[The Root Company|root organization]], and one or more sub-companies each with its own password policies.
−
[[image:password003.png|border]]
 
  
−
* '''Force Password Change''' - Appears with button marked '''Expire All Passwords Now'''. Ensures that all users will be forced to rest their password when they next log in.
+
|-
 +
||'''Disabled Inactive Account Message'''
 +
||Write in the text that will be displayed when a user is attempting to access an expired account.
 +
|-
 +
||'''Enable reCAPTCHA Validation'''
 +
||
 +
|-
 +
||'''Activation link life span'''
 +
||
 +
This function works with the @activationlink@ [[Password Variables to Set or Reset User Passwords|password variable]]. If the '''https://@url@@activationlink@ '''syntax is used in the '''Request Password '''section of [[Email#Email Templates for User Activation and Password|email templates]], this setting sets the duration that the activation link will be valid for the user in ''number of hours. ''
  
−
* '''First Login''' - Ensures that the user selects a password of their own choosing the first time they log into [[SmartSimple]]. <br />''(Does not count towards'' Maximum Password Update in 24 Hours ''setting.)''
+
* '''Note: '''Best practice is to provide around 24 hours. Providing too little time will force you to continuously resend links as users will be more likely to forget to activate their accounts in time. 
  
−
* '''Password Expiration''' - Each user will be forced to change their password once the selected number of days has passed. Any number of days can be set.
+
|-
 +
||'''Default Security Code'''
 +
||This is a hard-coded value to be entered when users request new passwords.  For example, 12345. 
 +
|-
 +
||'''Challenge Questions, delimited by semi-colons'''
 +
||
 +
You can set a series of challenge questions through which all users will be prompted to select one upon next login. Their answer to that question will be stored in the system, and if they forget their password, they will be prompted to enter this answer and click the activation link in the '''Forgot Password '''[[Email#Email Templates for User Activation and Password|email template]]. 
  
−
* '''Password History Check''' - You can set the number of previous passwords (to a maximum of 32) that the system will remember for each user. When changing their password, users will not be permitted to re-use a previous password until the specified number of unique passwords have been used.
+
* '''Note: '''The best challenge questions will have answers that are simple, memorable, not easy to guess, and will not change over time. 
  
 +
'''Example of Challenge Questions: '''
  
 +
: ''In what city or town was your first job?;''<br />''What is your mother's maiden name?;''<br />''What was your first pet's name?;''<br />''In what year was your father born? ''
 +
|}
 +
====Password Reset Message====
 +
Even further down at the bottom of the '''General '''page of '''Password and Activation Policies '''are features relating to a '''Password Reset Message '''and '''Persistent Login. '''
  
−
===Password Activation Settings===
+
:: [[File:Password reset message custom.png|800px|border]] 
−
Password Activation Settings can be set to add an extra layer of security to the system. These settings pertain to users who use the "Forgot Password" link on the login page.
+
In the text field box, write the content for the '''Reset Password '''message that a user will see if they need to reset their password. You may select between a default template or you may choose to make it custom. 
  
−
[[Image:Password-Activation-Settings.png]]
+
====Persistent Login====
 +
:: [[File:Persistent login.png|600px|border]] 
 +
The '''Persistent Login''' functionality provides for the use of a persistent secure cookie on the [[SmartSimple]] [[User|user]]'s computer to eliminate the need to use a username and password to log into the system. 
 +
Rather than having to log in to SmartSimple each time you open your web browser, a "cookie" can be installed on your computer that will automatically authenticate you, allowing you to bypass the login screen. (This setting can be [[System_Security_Permissions#Miscellaneous_Feature_Permission|enabled or disabled]] by your system administrator). In order for this feature to work, you must have the user's browser enabled to accept persistent cookies.
 +
====Rules for Password Activation Settings====
 +
When an organization has their password settings configured, then they will be used in full.
  
−
* '''Default Security Code''' - A hard-coded value to be entered when users request new passwords.
+
When an organization does not have their password settings configured, the system will go up the [[Organization hierarchy|organization hierarchy]] until it finds a parent company with password settings configured, and by default it will allow the organization to inherit those settings. '''Example: '''If only the [[The Root Company|root organization]] has its password settings configured, all other organizations would inherit the same policies, as they all fall under the root organization on the organization hierarchy. 
  
−
* '''Activation link life span''' - Works with the @activationlink@ [[Password Variables to Set or Reset User Passwords|password variable]]. If the '''<nowiki>https://@url@@activationlink@</nowiki>''' syntax is used in the ''Request Password'' section of [[User Email Templates]], this setting sets the duration that the activation link will be valid.
+
* '''Note: '''An organization will display informational text at the top saying that its password policies have not been configured until they are. 
  
−
* '''Challenge Questions, delimited by semi-colons''' - You can set a series of challenge questions, all users will be prompted to select a [[Challenge Question]] on next login. Their answer will be stored and they will be prompted to enter this answer if they forget their password and click the activation link in the "Forgot password" email template.
+
{| class="wikitable"
 +
|-
 +
||For when a new user is sent their password for the first time
 +
||
 +
* If the password activation settings have a '''default security code '''but no challenge questions, the user will be prompted to enter the default security code. 
 +
* If the password activation settings have a '''default security code '''and '''challenge questions, '''the user will be prompted to enter the default security code and then taken to a second screen to define an answer to one of the challenge questions. The user can then go their [[Profile]] and access the '''Change Password '''page to view and update their stored challenge question and answer.
 +
* The user will be presented with reCAPTCHA validation in all cases.
  
−
: [[Image:Challenge-question.png|link=]]
+
|-
−
: '''Note:''' An example of a good challenge question would be something that is simple, memorable, can't be guessed easily, and won't change over time.
+
||For when an existing user requests a new password
 +
||
 +
* If the password activation settings have a '''default security code '''but no challenge questions, the user will be prompted to enter the default security code. 
 +
* If the password activation settings have a '''default security ''''''code '''and '''challenge questions, '''the user will only be prompted to answer a challenge question.
 +
* The user will be presented with reCAPTCHA validation in all cases. 
  
−
===Rules for Password Activation Settings===
+
|}
 +
After a user has successfully completed the appropriate password activation process, they will be logged into that SmartSimple [[instance]] and their newly created password will become active. 
  
−
When a company has password settings configured, then these will be used in full.
+
====Custom Policy====
 +
* The '''Compose Custom Password Policy''' table provides the ability to define the custom password policy that matches your organization's security standards and provides control of each character type desired (upper case, lower case, numeric and/or symbols). You can also specify the minimum number of characters required for that character type.
 +
* The character mask used to define your selection will appear in the '''Custom Password Policy''' field. You can also write your own code and paste it into this field if desired.
 +
* The '''Validate Pattern''' button will open a window where you can test various passwords against the policy to see if they will pass or fail.
 +
* The value in the '''Custom Password Policy Description''' field will be displayed to users when setting/changing their password. You can use plain text or html in this field (For example, to insert a line break use ''&lt;br>'')
 +
* '''Note''': See also [[Custom Password Policy Examples]]
 +
[[Image:Custpwpolicy.png]]
  
−
When a company does not have password settings configured, the system will go up the Organizational hierarchy until it finds a parent company with password settings configured and then use these settings.
+
'''Important:''' When defining a custom password policy be sure to provide a detailed description of the policy in the '''Custom Password Policy Description''' field so that users are aware of the minimum requirement to enable them to create a valid password.
  
−
NOTE: When a company does not have password settings configure it will display informational text at the top saying it has not been configured.
+
If you need to translate the '''Custom Password Policy Description''' message you can use [[sslogic]]. It is often easiest to use [[System Variables]] for these. Example:
  
 +
<pre style="white-space: -o-pre-wrap; word-wrap: break-word;">&lt;!--@sslogic('@langid@'='2')-->&lt;br>@system.Password Policy - French@&lt;!--@else-->&lt;br>@system.Password Policy@&lt;!--@end--></pre>
 +
===Intruder Lockout Settings and Intruder Email Alert===
 +
The third tab in '''Password and Activation Policies, '''called '''Intruder Alert Settings, '''will determine the actions that should be taken if someone attempts to log into your copy of [[SmartSimple]] but cannot provide accurate credentials.
  
−
The following rules apply to the above settings when a '''new user is sent their password for the first time''':
+
:: [[File:Intruder alert settings new.png|600px|border]]
−
* If the Activation settings have a default security code but no challenge questions, the user will be prompted to enter the default security code.
+
{| class="wikitable"
−
* If the Activation settings have a default security code and a challenge questions, the user will be prompted to enter the default security code and then taken to second screen to define an answer to one of the the Challenge questions. The user can then go User Profile and access the Change Password page to view and update their stored challenge question and answer. 
+
|-
−
* The user will be presented with [[CAPTCHA]] validation in all cases.
+
||'''Number of Attempts'''
−
 
+
||Enter a number from 1-32 that will denote the amount of times someone can ''attempt ''to log in with an account (that is, with an incorrect password) before that account is locked. 
−
 
+
|-
−
The following rules apply to the above settings when an '''existing user requests a new password''':
+
||'''Lockout Duration'''
−
 
+
||
−
* If a default security code has been entered and no challenge questions have been entered, the user will be prompted to enter the default security code.
+
Select from a number of options the duration of the account lockout. Within this period, the user will have no ability to log in, even if their credentials are correct. 
−
* If a default security code has been entered and challenge questions have been entered, the user will only be prompted to answer a challenge question.
 
−
* The user will be presented with [[CAPTCHA]] validation in all cases.
 
−
 
 
−
After successful completion of Password Activation, the user will be logged in and their new password will be active.
 
−
 
 
−
===Intruder Lockout Settings===
 
−
[[image:password-006.png]]
 
−
 
 
−
These settings determine the actions that should be taken if someone attempts to log into your copy of [[SmartSimple]].
 
−
 
 
−
* '''Number of Attempts''' – the number of attempts to log in with an account before the account is locked.
 
−
 
 
−
* '''Lockout Duration''' – the duration of the account lockout. The [[User|user]] will not be able to log in during this period. Period can be set to 5 minutes, 15 minutes, 30 minutes, 1 hour, 3 hours, 12 hours, 24 hours or forever (until unlocked by [[Administrator|administrator]]).
 
−
 
 
−
* '''Lockout Message''' - a custom message to display to users when a user is locked out due to too many failed login attempts. This message will only display when a user has been locked out, and attempts to log in again with the correct password. Therefore, no information will be divulged to users that fail their login.
 
−
 
 
−
* The '''View Locked Users''' tab will display all [[User|users]] that have had their account locked.  
 
−
 
 
−
* If a user is locked, you can click on the '''Set Password''' button on the '''View Locked Users''' tab to reactivate the account and send the [[User|user]] a new [[Password|password]].
 
−
 
 
−
 
 
−
 
 
−
* ''Once an account has been locked for exceeding the number of permitted login attempts it will remain on the "locked users" list until the correct password is entered. This allows the administrator to see which users have been unable to log in, even if the configured lockout duration has passed and the account is no longer technically locked.''
 
−
 
 
−
* ''When an account has been locked for exceeding the allotted number of attempts, after the lockout time has passed they are permitted only one attempt at the correct password. A single incorrect password at this point will re-lock the account for the configured lockout duration. In other words, once someone is on the "locked user" list they are only permitted a single wrong attempt and they will be locked for the lockout duration again. This prevents would-be intruders from having multiple attempts to guess the password each time the lockout duration has passed. ''
 
−
 
 
−
===Password Reset Message===
 
−
[[image:password-005.png]]
 
−
 
 
−
This feature provides the ability to overwrite the standard Password Reset message with a custom message for your organization.
 
−
 
 
−
 
 
−
 
 
−
===Intruder Email Alert===
 
−
These settings define who should be informed by email if an intruder alert is detected. A default emial template is used and contains the following values:
 
−
 
 
−
[[File:10-12-2016 1-15-24 PM.png]]
 
−
 
 
−
The Default template uses the primary contact on the root company record to populate the '''Email To'''.
 
−
 
 
−
 
 
−
You can save the default template and then modify ifrequired.
 
−
 
 
−
* '''Email From''' – the “from” address for the email. If you do not set this value, the address: '''donotreply@smartsimple.com''' will be used.
 
−
* '''Email To''' – select the [[Internal|internal]] people to receive the email.
 
−
* '''Subject''' – the subject of the email. See below for the variables that you can use in the subject.
 
−
* '''Body''' – the body of the alert email. See below for the variables that you can use in the body.
 
−
 
 
−
'''Intruder Alert Email Variables''' – because the [[User|user]] is not logged into the system, the amount of information available is limited to IP Address '''@ip@''', the attempted username '''@username@''' and date/time '''@now@''' of the attempted login.
 
−
 
 
−
 
 
−
 
 
−
===Intruder Log===
 
−
The '''View Log''' tab is used to access the '''Intruder Alert''' log.
 
−
 
 
−
[[Image:Glob13.png]]
 
−
 
 
−
* The list can be sorted by clicking the column title.
 
−
* You can filter the list by [[Username|username]], year, and month.
 
−
 
 
−
 
 
−
===Hierarchical Password Policy===
 
−
When viewing a company in your hierarchy, select '''Settings > Password Policy''' to define. <br/><br/>
 
−
 
 
−
A different password policy can be defined for each company within the system. <br/><br/>
 
−
 
 
−
If there are password policies defined for a company then it will automatically apply to all sub-companies in the [[Creating_an_Organization_Chart_and_Company_Hierarchy|hierarchy]], unless those sub-companies have defined their own password policy. <br/><br/>
 
−
 
 
−
If there are no password policies defined for a company, then the system will look at the companies above it in the hierarchy, and if one of these parent companies have a password policy set then it will use these settings. <br/><br/>
 
−
 
 
−
If there are no password policies defined for a company, or any of the companies above it in the hierarchy, then the password policy set in [[Global_Settings|Global Settings]] will apply.<br/><br/>
 
−
 
 
−
''NOTE:'' There are no settings stored in the database for a company until someone actually opens the Password Policy page for that company and clicks Save.
 
  
−
==View Locked Users==
+
* Options: 5 minutes, 15 minutes, 20 minutes, 1 hour, 3 hours, 12 hours, 24 hours or Forever
−
This option is only available from the Password Policy on the [[Category:Global Settings|Global settings]]. It cannot be accessed for the individual Password policies for the different companies in your organizations hierarchy.
+
* '''Note: '''If the '''Forever '''option is selected for the lockout duration, the user will have no access to login ''until ''manually unlocked by the [[Global User Administrator|System Administrator]] 
  
−
[[Image:ViewLockedUsers.png|1000px]]
+
|}
 +
The latter half of this page has the heading '''Intruder Email Alert - '''using a default template, it allows you to customize the email alert when someone has been locked out because of intruding attempts. 
  
−
The '''View Locked Users''' tab will display all [[User|users]] that have had their account locked.  
+
{| class="wikitable"
 +
|-
 +
||'''Email From'''
 +
||The From Address for the email alert. If you do not manually set this value, then the address '''donotreply@smartsimple.com '''will be used.
 +
|-
 +
||'''Email To'''
 +
||
 +
Select the [[Internal]] people to receive the email alert. Click the '''binoculars icon '''for a full list of internal staff, from which you can select who to send the email alert to.
  
−
* Once an account has been locked for exceeding the number of permitted login attempts it will remain on the "locked users" list until the correct password is entered. This allows the administrator to see which users have been unable to log in, even if the configured lockout duration has passed and the account is no longer technically locked.
+
* '''Note: '''The Default Template will use the [[Organization hierarchy#Organization Ownership|primary contact]] of the [[The Root Company|root organization]] to populate the '''Email To '''field. 
  
−
* When an account has been locked for exceeding the alloted number of attempts, after the lockout time has passed they are permitted only one attempt at the correct password. A single incorrect password at this point will re-lock the account for the configured lockout duration. In other words, once someone is on the "locked user" list they are only permitted a single wrong attempt and they will be locked for the lockout duration again. This prevent would-be intruders from having multiple attempts to guess the password each time the lockout duration has passed.
+
|-
 +
||'''Subject'''
 +
||The subject of the email. 
 +
|-
 +
||'''Body'''
 +
||'''Sample Template - '''Clicking this will populate the text window automatically with a template of what the email alert will contain. It will include [[System Variables]]. 
 +
|}
 +
'''Intruder Alert Email Variables''' – because the [[User|user]] is not logged into the system, the amount of information available is limited to IP Address '''@ip@''', the attempted username '''@username@''' and date/time '''@now@''' of the attempted login.
  
−
* If a user is locked, you can click on the '''Set Password''' button to reactivate the account and send the [[User|user]] a new [[Password|password]].
+
===Locked Users===
 +
The '''Locked Users '''tab will display a [[List View Overview|list]] of all users that have had their account locked. 
  
 +
:: [[File:Locked user lists.png|800px|border]]
 +
If a user is locked, you can click on the '''Set Password''' button on the '''View Locked Users''' tab to reactivate the account and send the [[User|user]] a new [[Password|password]].
  
 +
Once an account has been locked for exceeding the number of permitted login attempts, it will remain on the '''Locked Users '''list until the correct password is entered. This allows the SysAdmin to see which users have been unable to log in, even if the configured lockout duration has passed and the account is no longer technically locked.
  
−
==View Expired Users==
+
When an account has been locked for exceeding the number of permitted login attempts, after the lockout time has passed they are permitted only ''ONE ''attempt at the correct password. 
−
This option is only available from the Password Policy on the [[Category:Global Settings|Global settings]]. It can not be accessed for the individual Password policies for the different companies in your organizations hierarchy.
 
  
−
[[Image:ViewExpiredUsers.png|1000px]]
+
* A single incorrect password at this point will '''re-lock '''the account for the configured lockout duration. 
 +
* This is a preventative measure so that would-be intruders do not have multiple attempts to guess the password each time the lockout duration has passed. 
  
−
* The '''View Expired Users''' tab will display all [[User|users]] that had their accounts disabled due to [[Password_Policy#Section_1:_Persistent_Login_and_Expiration_of_Inactive_Accounts|inactivity]]. There will be page navigation options if there is an overly long list.
+
===Disabled Inactive Users===
 +
This function is only available from '''Global Settings > Security > Password and Activation Policies; '''it is not accessible from individual password policies for the different companies in your [[Organization hierarchy|organization hierarchy]]. 
  
−
* Once an account has been expired for having been inactive for longer that the permitted number of days it will remain on the "expired users" list until their password is reset. This allows the administrator to see which users have been expired.
+
:: [[File:Disabled inactive users.png|800px|border]] 
 +
Similarly to the '''Locked Users '''tab, the '''Disabled Inactive ''''''Users '''tab will provide a [[List View Overview|list]] of all expired [[User|users]] in your system. Their accounts have expired as a result of inactivity and a disabling that can be configured after a certain amount of time (see [[Password Policy#Disable Inactive Accounts and Activation Settings|Disable Inactive Accounts]].
  
−
* If a user is expired, you can click on the '''Send Password''' button to reactivate the account and send the [[User|user]] a new [[Password|password]].
+
* Once an account has been disabled as a result of overly long inactivity, the user will remain on this list until their password is reset. This allows the SysAdmin to see which users have had their accounts disabled because of inactivity.
 +
* If an inactive user is disabled, there will be a '''Send Password '''button next to their name on this tab - that way, you can reactive the account and send the user a new password with which they can log into the system.
  
 
==Single Sign-On==
 
==Single Sign-On==

Latest revision as of 18:30, 18 January 2022

Overview

Password Policy is used to configure the password policies within SmartSimple with your organizational standards. It is best practice to ensure that these policies match the other systems deployed by your organization; consequently, these policies allow for extensive configuration options. 

Password Policies include the following:

  • The ability to control the length and complexity of passwords
  • The password expiration time period 
  • The password frequency usage 
  • The method for sending new requested passwords (via Email Templates) 
  • Word restrictions 
  • The number of retries allowed
  • The lockout time for the account if they exceed retry quota 
  • Email alerts for invalid passwords 

Multiple password policies can be supported by the system. This feature provides for less stringent policies for types of users that infrequently access the system - for example, External contacts who would only use the system for an application. Alternative password policies can be set for any level in the organization hierarchy. 

You can also set individual password policies for the different companies of your organization hierarchy. However, they will be able to edit the policy only, and not edit the the Activation Emails, which can only be configured from Global Settings by a user with System Administrator privileges. 

Note: In all cases of password policies, common words or known common passwords are ineligible to be used as SmartSimple passwords. 

Configuration - Essentials

How to Access the Password Settings

1. Click on the 9-square menu icon on the top right of your page.

052919 MenuIcon.png 

2. Under the heading Configuration, select Global Settings. 

3. Click on the tab labelled Security.

4. Click on the hyperlink called Password and Activation Policies.

A page displayed with numerous settings and tabs related to your system's password and activation policies will appear. On this page, you can modify the required complexities of passwords, email templates for activating users and setting passwords, disable inactive accounts, and more. 

General password activation policies.png 
Tab Name Overview of Features and Functionality
General Provides access to modify, configure, or enable/disable general password settings, the deactivation of inactive accounts, activation settings, password reset messages, and persistent login.
Activation Email Templates Allows modification and configuration of Email Templates for the following functions: New User, Request Password, and Password Change Notification. Can also set a default language and From Address. 
Intruder Alert Settings Allows modification of intruder settings, including the amount of retries, the lockout duration, and the content for an email alert when there is an intrusion.
Invalid Login Audit Provides a list of invalid logins by username, IP Address, and time for auditing and record-keeping purposes.
Locked Users Provides a list of locked users by name, Lockout Time, and the feature to directly set that user with a new password. 
Disabled Inactive Users Provides a list of disabled, inactive users by name and date of disabling. 

Password Encryption

For your information, if necessary: 

SmartSimple uses the SHA-256 algorithm, combined with salt hashing, in order to encrypt passwords.

Password Settings

This section, under the first tab of the Password and Activation Policies labelled General, is used to set password attributes. 

General password settings.png
Password Length The minimum length allowed for a password; the number inputted must be between 6 - 32 characters.
Complexity

Set the level of character-type complexity required for a password. The options are as follows: 

  • No Restriction - any character can be used; this is the default. 
  • Alpha Only - only letters are able to be used.
  • Alpha & Numeric - both letters and numbers must be used in the password.
  • Alpha & Numeric & Special Characters - a combination of letters, numbers, and special characters must be used. 
  • Custom Policy - a password policy can be custom-defined. 

Disable Restriction of Common Passwords - Toggling on this function will then enable the user's ability to use common passwords as their password. This is not recommended for security reasons, as common passwords are easier to guess and to enable security breaches. 

Force Password Change

Force New Password on First Login - This will ensure that each individual user will be forced to change their password from a system-generated or SysAdmin-determined password into one of their own accord. 

  • Note: This first login does not count towards the Maximum Password Update in 24 Hours setting. 


Expire All Passwords Now - This is a handy button that will immediately invalidate all passwords in the system, ensuring that each user will have to reset their passwords when they next log in. A good use-case of this function might be if you updated your password policy to require more complex passwords; by expiring all passwords, every user in your system will have to create new passwords that fall under the new password criteria. 

Password Expiration Each user will be forced to change their password once the selected number of days has passed. Doing so every quarter or so is good security practice; however, any number of days can be set. On each login, the system will check how many days until the password expires and will notify the user their password is about to expire in X days.
Password History Check You can set the number of previous passports (to a maximum of 32) that the system will remember for each user. When changing their password, users will not be permitted to re-use a previous password that is remembered by the Password History until the specified number of unique passwords have been used. 
Maximum Password Changes in 24 Hours

This will set the maximum number of password changes any individual user is able to make within a 24-hour period. This is to prevent users from bypassing the password history restriction by changing their password repeatedly in order to return to a previously used password.

  • This setting only pertains to password changes by use of Update Password by the user - it is not relevant to the Forgot Password link nor to the System Administrators ability to Set Password for users. 
Password Data Restriction

Configuring this setting will restrict password settings so that values such as first name, last name, or organization name cannot be used in the password. Any number of fields can be selected from both the Organization or the Contact Profile. 

Organization Field - Both standard and custom fields are supported. 

Contact Field - Both standard and custom fields are supported. 

Disable Inactive Accounts and Activation Settings

Scrolling down further on the General password settings page will bring you to the sections that allow you to set the criteria for disabling and activating accounts. 

User accounts can be configured to automatically become disabled after a predetermined period of inactivity. Once disabled, a password reset is required by the user to regain access to the system. This feature adds to the many user management options within the system.

Password disable and activate.png
Disable user accounts after X days Insert the number of days a user account is inactive before it is disabled. In order to disable this feature, simply leave the field blank.
Apply Policy to All Sub-Companies

Click this button to force-update the password policy related to the current organization and all sub-companies. 

Note: This is applicable when an organization has a root organization, and one or more sub-companies each with its own password policies.

Disabled Inactive Account Message Write in the text that will be displayed when a user is attempting to access an expired account.
Enable reCAPTCHA Validation
Activation link life span

This function works with the @activationlink@ password variable. If the https://@url@@activationlink@ syntax is used in the Request Password section of email templates, this setting sets the duration that the activation link will be valid for the user in number of hours. 

  • Note: Best practice is to provide around 24 hours. Providing too little time will force you to continuously resend links as users will be more likely to forget to activate their accounts in time. 
Default Security Code This is a hard-coded value to be entered when users request new passwords.  For example, 12345. 
Challenge Questions, delimited by semi-colons

You can set a series of challenge questions through which all users will be prompted to select one upon next login. Their answer to that question will be stored in the system, and if they forget their password, they will be prompted to enter this answer and click the activation link in the Forgot Password email template. 

  • Note: The best challenge questions will have answers that are simple, memorable, not easy to guess, and will not change over time. 

Example of Challenge Questions: 

In what city or town was your first job?;
What is your mother's maiden name?;
What was your first pet's name?;
In what year was your father born? 

Password Reset Message

Even further down at the bottom of the General page of Password and Activation Policies are features relating to a Password Reset Message and Persistent Login. 

Password reset message custom.png 

In the text field box, write the content for the Reset Password message that a user will see if they need to reset their password. You may select between a default template or you may choose to make it custom. 

Persistent Login

Persistent login.png 

The Persistent Login functionality provides for the use of a persistent secure cookie on the SmartSimple user's computer to eliminate the need to use a username and password to log into the system.  Rather than having to log in to SmartSimple each time you open your web browser, a "cookie" can be installed on your computer that will automatically authenticate you, allowing you to bypass the login screen. (This setting can be enabled or disabled by your system administrator). In order for this feature to work, you must have the user's browser enabled to accept persistent cookies.

Rules for Password Activation Settings

When an organization has their password settings configured, then they will be used in full.

When an organization does not have their password settings configured, the system will go up the organization hierarchy until it finds a parent company with password settings configured, and by default it will allow the organization to inherit those settings. Example: If only the root organization has its password settings configured, all other organizations would inherit the same policies, as they all fall under the root organization on the organization hierarchy. 

  • Note: An organization will display informational text at the top saying that its password policies have not been configured until they are. 
For when a new user is sent their password for the first time
  • If the password activation settings have a default security code but no challenge questions, the user will be prompted to enter the default security code. 
  • If the password activation settings have a default security code and challenge questions, the user will be prompted to enter the default security code and then taken to a second screen to define an answer to one of the challenge questions. The user can then go their Profile and access the Change Password page to view and update their stored challenge question and answer.
  • The user will be presented with reCAPTCHA validation in all cases.
For when an existing user requests a new password
  • If the password activation settings have a default security code but no challenge questions, the user will be prompted to enter the default security code. 
  • If the password activation settings have a 'default security 'code and challenge questions, the user will only be prompted to answer a challenge question.
  • The user will be presented with reCAPTCHA validation in all cases. 

After a user has successfully completed the appropriate password activation process, they will be logged into that SmartSimple instance and their newly created password will become active. 

Custom Policy

  • The Compose Custom Password Policy table provides the ability to define the custom password policy that matches your organization's security standards and provides control of each character type desired (upper case, lower case, numeric and/or symbols). You can also specify the minimum number of characters required for that character type.
  • The character mask used to define your selection will appear in the Custom Password Policy field. You can also write your own code and paste it into this field if desired.
  • The Validate Pattern button will open a window where you can test various passwords against the policy to see if they will pass or fail.
  • The value in the Custom Password Policy Description field will be displayed to users when setting/changing their password. You can use plain text or html in this field (For example, to insert a line break use <br>)
  • Note: See also Custom Password Policy Examples

Custpwpolicy.png

Important: When defining a custom password policy be sure to provide a detailed description of the policy in the Custom Password Policy Description field so that users are aware of the minimum requirement to enable them to create a valid password.

If you need to translate the Custom Password Policy Description message you can use sslogic. It is often easiest to use System Variables for these. Example: 

<!--@sslogic('@langid@'='2')--><br>@system.Password Policy - French@<!--@else--><br>@system.Password Policy@<!--@end-->

Intruder Lockout Settings and Intruder Email Alert

The third tab in Password and Activation Policies, called Intruder Alert Settings, will determine the actions that should be taken if someone attempts to log into your copy of SmartSimple but cannot provide accurate credentials.

Intruder alert settings new.png
Number of Attempts Enter a number from 1-32 that will denote the amount of times someone can attempt to log in with an account (that is, with an incorrect password) before that account is locked. 
Lockout Duration

Select from a number of options the duration of the account lockout. Within this period, the user will have no ability to log in, even if their credentials are correct. 

  • Options: 5 minutes, 15 minutes, 20 minutes, 1 hour, 3 hours, 12 hours, 24 hours or Forever
  • Note: If the Forever option is selected for the lockout duration, the user will have no access to login until manually unlocked by the System Administrator 

The latter half of this page has the heading Intruder Email Alert - using a default template, it allows you to customize the email alert when someone has been locked out because of intruding attempts. 

Email From The From Address for the email alert. If you do not manually set this value, then the address donotreply@smartsimple.com will be used.
Email To

Select the Internal people to receive the email alert. Click the binoculars icon for a full list of internal staff, from which you can select who to send the email alert to.

Subject The subject of the email. 
Body Sample Template - Clicking this will populate the text window automatically with a template of what the email alert will contain. It will include System Variables. 

Intruder Alert Email Variables – because the user is not logged into the system, the amount of information available is limited to IP Address @ip@, the attempted username @username@ and date/time @now@ of the attempted login.

Locked Users

The Locked Users tab will display a list of all users that have had their account locked. 

Locked user lists.png

If a user is locked, you can click on the Set Password button on the View Locked Users tab to reactivate the account and send the user a new password.

Once an account has been locked for exceeding the number of permitted login attempts, it will remain on the Locked Users list until the correct password is entered. This allows the SysAdmin to see which users have been unable to log in, even if the configured lockout duration has passed and the account is no longer technically locked.

When an account has been locked for exceeding the number of permitted login attempts, after the lockout time has passed they are permitted only ONE attempt at the correct password. 

  • A single incorrect password at this point will re-lock the account for the configured lockout duration. 
  • This is a preventative measure so that would-be intruders do not have multiple attempts to guess the password each time the lockout duration has passed. 

Disabled Inactive Users

This function is only available from Global Settings > Security > Password and Activation Policies; it is not accessible from individual password policies for the different companies in your organization hierarchy. 

Disabled inactive users.png 

Similarly to the Locked Users 'tab, the Disabled Inactive 'Users tab will provide a list of all expired users in your system. Their accounts have expired as a result of inactivity and a disabling that can be configured after a certain amount of time (see Disable Inactive Accounts.

  • Once an account has been disabled as a result of overly long inactivity, the user will remain on this list until their password is reset. This allows the SysAdmin to see which users have had their accounts disabled because of inactivity.
  • If an inactive user is disabled, there will be a Send Password button next to their name on this tab - that way, you can reactive the account and send the user a new password with which they can log into the system.

Single Sign-On

For information on the Single Sign-On settings and functionality, please refer to the Single Sign-On page.

See Also

Retrieved from ‘https://wiki.smartsimple.com/index.php?title=Password_Policy&oldid=39406’