Changes

||'''[[Password Policy#Password Settings|General]]'''

||'''[[Email#Email Templates for User Activation and Password|Activation Email Templates]]'''

||'''[[Password Policy#Intruder Lockout Settings and Intruder Email Alert|Intruder Alert Settings]]'''

||'''[[Login Page#Invalid Login Audit|Invalid Login Audit]]'''

||'''[[Password Policy#View Locked Users|Locked Users]]'''

||'''[[Disable User Account After Inactive Period|Disabled Inactive Users Users]]'''

===General Password Settings===

||The minimum length allowed for a password; the number inputted must be between '''6 - 32 characters.'''

Set the level of character-type complexity required for a password. The options are as follows: 

||'''Force New Password on First Login- '''This will ensure that each individual user will be forced to change their password from a system-generated or SysAdmin-determined password into one of their own accord.  * '''Note: '''This first login does not count towards the Maximum Password Update in 24 Hours setting.   '''Expire All Passwords Now - '''This is a handy button that will immediately invalidate all passwords in the system, ensuring that each user will have to reset their passwords when they next log in. A good use-case of this function might be if you updated your password policy to require more complex passwords; by expiring all passwords, every user in your system will have to create new passwords that fall under the new password criteria.  

||Each user will be forced to change their password once the selected number of days has passed. Doing so every quarter or so is good security practice; however, any number of days can be set. On each login, the system will check how many days until the password expires and will notify the user their password is about to expire in X days.

||You can set the number of previous passports (to a maximum of 32) that the system will remember for each user. When changing their password, users will not be permitted to re-use a previous password that is remembered by the '''Password History '''until the specified number of unique passwords have been used. 

||'''Disable user accountsafter ''X ''days'''||Insert the number of days a user account is inactive before it is disabled. In order to disable this feature, simply leave the field blank.

||Write in the text that will be displayed when a user is attempting to access an expired account.

||This is a hard-coded value to be entered when users request new passwords.  For example, 12345. 

Description In the text field box, write the content for the '''<u>Persistent Login</u>Reset Password ''':message that a user will see if they need to reset their password. You may select between a default template or you may choose to make it custom. 

Rather than having to log in to SmartSimple each time you open your web browserWhen an organization does not have their password settings configured, the system will go up the [[Organization hierarchy|organization hierarchy]] until it finds a "cookie" can be installed on your computer that parent company with password settings configured, and by default it will automatically authenticate you, allowing you allow the organization to bypass inherit those settings. '''Example: '''If only the login screen. (This setting can be [wiki/System_Security_Permissions#Miscellaneous_Feature_Permission enabled or disabled[The Root Company|root organization]] by your system administrator). In order for this feature to workhas its password settings configured, all other organizations would inherit the same policies, you must have as they all fall under the root organization on the user's browser enabled to accept persistent cookiesorganization hierarchy. 

===Expiration of Inactive Accounts===* '''This feature will be deprecated in the July 2016 upgrade.Note: ''''''Disable Inactive Accounts''' provides An organization will display informational text at the ability to automatically disable a user account after a predetermined period of time. A top saying that its password reset is required by the user to regain access to the systempolicies have not been configured until they are. The main options are: 

{| class="wikitable"|-||For when a new user is sent their password for the first time||* If the password activation settings have a '''Disable user accounts after 'default security code '[X]'' days''' - The number of days a but no challenge questions, the user account is inactive before it is disabled. Leave this field blank will be prompted to disable this featureenter the default security code. * If the password activation settings have a '''Apply Policy to All Sub-Companiesdefault security code ''' - Click button to force-update the password policy of the current company and all sub-companies. and '''Note:challenge questions, '''This is applicable when an organization has a root company the user will be prompted to enter the default security code and then taken to a second screen to define an answer to one or more sub-companies each with it's own password policiesof the challenge questions.* The user can then go their [[Profile]] and access the '''Disabled Inactive Account MessageChange Password ''' - page to view and update their stored challenge question and answer.* The text to user will be displayed to a user trying to access an expired accountpresented with reCAPTCHA validation in all cases.

===Password Settings Section===|-This section is used ||For when an existing user requests a new password||* If the password activation settings have a '''default security code '''but no challenge questions, the user will be prompted to set enter the default security code. * If the password attributesactivation settings have a '''default security ''''''code '''and '''challenge questions, '''the user will only be prompted to answer a challenge question.* The user will be presented with reCAPTCHA validation in all cases. 

::: [[File:Password general settings.png|450px|border]]}'''Maximum Password Update in 24 Hours''' – Sets the maximum number of password changes After a user can make within a 24 hour period can be defined. This is to prevent users bypassing has successfully completed the appropriate password history restriction by changing their password repeatedly to return to a previously used password. This setting only pertains to password changes by use of "Update Password" by useractivation process, not to the "Forgot Password" link or system administrators using "Set Password." '''Password length''' – the minimum length allowed for a [[Password|password]], between '''6 and 32 characters'''. '''Data Restrictions''' - passwords set by users can be restricted so values such as first name, last name or organization name cannot they will be used in the password. Any number of fields can be selected from both the organization or the user profile; standard and custom fields are supported. [[image:password-008.png]] In the example above City, Country and Phone fields have been selected from the user's organization record and first name, last name, birthplace and nickname fields have been selected from the user profile.   ====Password Complexity===='''Complexity''' – the level of complexity required in the logged into that SmartSimple [[Password|passwordinstance]], the options are: * '''No Restriction''' – any character can be used. This is the default.* '''Alpha Only''' – only letters can be used.* '''Alpha & Numeric''' – letters and numbers must be used in the password.* '''Alpha & Numeric & Special characters''' – letters, numbers and special characters must be used.* '''Custom Policy''' - a their newly created password policy can be custom definedwill become active. 

===New Password Settings===:: [[imageFile:password003Intruder alert settings new.png|600px|border]]{| class="wikitable"|-||'''Number of Attempts'''||Enter a number from 1-32 that will denote the amount of times someone can ''attempt ''to log in with an account (that is, with an incorrect password) before that account is locked. |-||'''Lockout Duration'''||Select from a number of options the duration of the account lockout. Within this period, the user will have no ability to log in, even if their credentials are correct. 

* Options: 5 minutes, 15 minutes, 20 minutes, 1 hour, 3 hours, 12 hours, 24 hours or Forever* '''Force Password ChangeNote: ''' - Appears with button marked If the '''Expire All Passwords NowForever '''. Ensures that all users option is selected for the lockout duration, the user will be forced have no access to rest their password when they next log in.login ''until ''manually unlocked by the [[Global User Administrator|System Administrator]] 

* |}The latter half of this page has the heading '''First LoginIntruder Email Alert - ''' - Ensures that using a default template, it allows you to customize the user selects a password email alert when someone has been locked out because of their own choosing the first time they log into [[SmartSimple]]. <br />''(Does not count towards'' Maximum Password Update in 24 Hours ''settingintruding attempts.)'' 

* {| class="wikitable"|-||'''Email From'''||The From Address for the email alert. If you do not manually set this value, then the address '''Password Expirationdonotreply@smartsimple.com ''' - Each user will be forced used.|-||'''Email To'''||Select the [[Internal]] people to change their password once receive the selected number of days has passedemail alert. Any number Click the '''binoculars icon '''for a full list of days internal staff, from which you can be setselect who to send the email alert to.

* '''Password History CheckNote: ''' - You can set The Default Template will use the number of previous passwords (to a maximum [[Organization hierarchy#Organization Ownership|primary contact]] of 32) that the system will remember for each user. When changing their password, users will not be permitted [[The Root Company|root organization]] to re-use a previous password until the specified number of unique passwords have been usedpopulate the '''Email To '''field. 

===Password Activation Settings===Password Activation Settings can be set to add an extra layer of security to the system. These settings pertain to users who use the "Forgot Password" link on the login page. [[Image:Password-Activation-Settings.png]] * '''Default Security Code''' - A hard-coded value to be entered when users request new passwords. * '''Activation link life span''' - Works with the @activationlink@ [[Password Variables to Set or Reset User Passwords|password variable]]. If the '''<nowiki>https://@url@@activationlink@</nowiki>''' syntax is used in the ''Request Password'' section of [[User Email Templates]], this setting sets the duration that the activation link will be valid. * '''Challenge Questions, delimited by semi-colons''' - You can set a series of challenge questions, all users will be prompted to select a [[Challenge Question]] on next login. Their answer will be stored and they will be prompted to enter this answer if they forget their password and click the activation link in the "Forgot password" email template. File: [[Image:Challenge-question.png|link=]]: '''Note:''' An example of a good challenge question would be something that is simple, memorable, can't be guessed easily, and won't change over time.===Rules for Password Activation Settings===When a company has password settings configured, then these will be used in full. When a company does not have password settings configured, the system will go up the Organizational hierarchy until it finds a parent company with password settings configured and then use these settings. NOTE: When a company does not have password settings configure it will display informational text at the top saying it has not been configured.  The following rules apply to the above settings when a '''new user is sent their password for the first time''': * If the Activation settings have a default security code but no challenge questions, the user will be prompted to enter the default security code.* If the Activation settings have a default security code and a challenge questions, the user will be prompted to enter the default security code and then taken to second screen to define an answer to one of the the Challenge questions. The user can then go User Profile and access the Change Password page to view and update their stored challenge question and answer.* The user will be presented with [[CAPTCHA]] validation in all cases.  The following rules apply to the above settings when an '''existing user requests a new password''': * If a default security code has been entered and no challenge questions have been entered, the user will be prompted to enter the default security code.* If a default security code has been entered and challenge questions have been entered, the user will only be prompted to answer a challenge question.* The user will be presented with [[CAPTCHA]] validation in all cases. After successful completion of Password Activation, the Locked user will be logged in and their new password will be active. ===Intruder Lockout Settings===[[image:password-006lists.png]] These settings determine the actions that should be taken if someone attempts to log into your copy of [[SmartSimple]]. * '''Number of Attempts''' – the number of attempts to log in with an account before the account is locked. * '''Lockout Duration''' – the duration of the account lockout. The [[User|user]] will not be able to log in during this period. Period can be set to 5 minutes, 15 minutes, 30 minutes, 1 hour, 3 hours, 12 hours, 24 hours or forever (until unlocked by [[Administrator800px|administratorborder]]). * '''Lockout Message''' - a custom message to display to users when a user is locked out due to too many failed login attempts. This message will only display when a user has been locked out, and attempts to log in again with the correct password. Therefore, no information will be divulged to users that fail their login. * The '''View Locked Users''' tab will display all [[User|users]] that have had their account locked. * If a user is locked, you can click on the the '''Set Password''' button  button on the the '''View Locked Users''' tab  tab to reactivate the account and send the the [[User|user]] a new [[Password|password]].  * ''Once an account has been locked for exceeding the number of permitted login attempts it will remain on the "locked users" list until the correct password is entered. This allows the administrator to see which users have been unable to log in, even if the configured lockout duration has passed and the account is no longer technically locked.'' * ''When an account has been locked for exceeding the allotted number of attempts, after the lockout time has passed they are permitted only one attempt at the correct password. A single incorrect password at this point will re-lock the account for the configured lockout duration. In other words, once someone is on the "locked user" list they are only permitted a single wrong attempt and they will be locked for the lockout duration again. This prevents would-be intruders from having multiple attempts to guess the password each time the lockout duration has passed. '' ===Password Reset Message===[[image:password-005.png]] This feature provides the ability to overwrite the standard Password Reset message with a custom message for your organization.   ===Intruder Email Alert===These settings define who should be informed by email if an intruder alert is detected. A default emial template is used and contains the following values: [[File:10-12-2016 1-15-24 PM.png]] The Default template uses the primary contact on the root company record to populate the '''Email To'''.  You can save the default template and then modify ifrequired. * '''Email From''' – the “from” address for the email. If you do not set this value, the address: '''donotreply@smartsimple.com''' will be used.* '''Email To''' – select the [[Internal|internal]] people to receive the email.* '''Subject''' – the subject of the email. See below for the variables that you can use in the subject.* '''Body''' – the body of the alert email. See below for the variables that you can use in the body. '''Intruder Alert Email Variables''' – because the [[User|user]] is not logged into the system, the amount of information available is limited to IP Address '''@ip@''', the attempted username '''@username@''' and date/time '''@now@''' of the attempted login.   ===Intruder Log===The '''View Log''' tab is used to access the '''Intruder Alert''' log. [[Image:Glob13.png]] * The list can be sorted by clicking the column title.* You can filter the list by [[Username|username]], year, and month.  ===Hierarchical Password Policy===When viewing a company in your hierarchy, select '''Settings > Password Policy''' to define. <br/><br/> A different password policy can be defined for each company within the system. <br/><br/> If there are password policies defined for a company then it will automatically apply to all sub-companies in the [[Creating_an_Organization_Chart_and_Company_Hierarchy|hierarchy]], unless those sub-companies have defined their own password policy. <br/><br/> If there are no password policies defined for a company, then the system will look at the companies above it in the hierarchy, and if one of these parent companies have a password policy set then it will use these settings. <br/><br/> If there are no password policies defined for a company, or any of the companies above it in the hierarchy, then the password policy set in [[Global_Settings|Global Settings]] will apply.<br/><br/> ''NOTE:'' There are no settings stored in the database for a company until someone actually opens the Password Policy page for that company and clicks Save. ==View Locked Users==This option is only available from the Password Policy on the [[Category:Global Settings|Global settings]]. It cannot be accessed for the individual Password policies for the different companies in your organizations hierarchy. [[Image:ViewLockedUsers.png|1000px]] The '''View Locked Users''' tab will display all [[User|users]] that have had their account locked. * Once an account has been locked for exceeding the number of permitted login attempts it will remain on the "locked users" list until the correct password is entered. This allows the administrator to see which users have been unable to log in, even if the configured lockout duration has passed and the account is no longer technically locked. * When an account has been locked for exceeding the alloted number of attempts, after the lockout time has passed they are permitted only one attempt at the correct password. A single incorrect password at this point will re-lock the account for the configured lockout duration. In other words, once someone is on the "locked user" list they are only permitted a single wrong attempt and they will be locked for the lockout duration again. This prevent would-be intruders from having multiple attempts to guess the password each time the lockout duration has passed. * If a user is locked, you can click on the '''Set Password''' button to reactivate the account and send the [[User|user]] a new  a new [[Password|password]].

==View Expired Users==This option is only available from When an account has been locked for exceeding the Password Policy on number of permitted login attempts, after the [[Category:Global Settings|Global settings]]. It can not be accessed for the individual Password policies for lockout time has passed they are permitted only ''ONE ''attempt at the different companies in your organizations hierarchycorrect password. 

[[Image:ViewExpiredUsers* A single incorrect password at this point will '''re-lock '''the account for the configured lockout duration.png|1000px]] * This is a preventative measure so that would-be intruders do not have multiple attempts to guess the password each time the lockout duration has passed. 

* The ===Disabled Inactive Users===This function is only available from '''View Expired UsersGlobal Settings > Security > Password and Activation Policies; ''' tab will display all it is not accessible from individual password policies for the different companies in your [[UserOrganization hierarchy|usersorganization hierarchy]] that had their accounts disabled due to [[Password_Policy#Section_1:_Persistent_Login_and_Expiration_of_Inactive_Accounts|inactivity]]. There will be page navigation options if there is an overly long list. 

* Once an account has been expired for having been :: [[File:Disabled inactive for longer that users.png|800px|border]] Similarly to the permitted number '''Locked Users '''tab, the '''Disabled Inactive ''''''Users '''tab will provide a [[List View Overview|list]] of days it will remain on the "all expired [[User|users" list until their password is reset]] in your system. This allows the administrator to see which users Their accounts have been expiredas a result of inactivity and a disabling that can be configured after a certain amount of time (see [[Password Policy#Disable Inactive Accounts and Activation Settings|Disable Inactive Accounts]].

* Once an account has been disabled as a result of overly long inactivity, the user will remain on this list until their password is reset. This allows the SysAdmin to see which users have had their accounts disabled because of inactivity.* If a an inactive user is expireddisabled, you can click on the there will be a '''Send PasswordPassword ''' button next to reactivate their name on this tab - that way, you can reactive the account and send the [[User|user]] a new [[Password|password]]with which they can log into the system.