||'''Overview of Features and Functionality'''
|-
||'''[[Password Policy#Password Settings|General]]'''
||Provides access to modify, configure, or enable/disable general password settings, the deactivation of inactive accounts, activation settings, password reset messages, and persistent login.
|-
||'''[[Email#Email Templates for User Activation and Password|Activation Email Templates]]'''
||Allows modification and configuration of Email Templates for the following functions: New User, Request Password, and Password Change Notification. Can also set a default language and From Address.
|-
||'''[[Password Policy#Intruder Lockout Settings and Intruder Email Alert|Intruder Alert Settings]]'''
||Allows modification of intruder settings, including the amount of retries, the lockout duration, and the content for an email alert when there is an intrusion.
|-
||'''[[Login Page#Invalid Login Audit|Invalid Login Audit]]'''
||Provides a [[List View Overview|list]] of invalid logins by username, IP Address, and time for auditing and record-keeping purposes.
|-
||'''[[Password Policy#View Locked Users|Locked Users]]'''
||Provides a list of locked users by name, Lockout Time, and the feature to directly set that user with a new password.
|-
||'''[[Disable User Account After Inactive Period|Disabled Inactive Users Users]]'''
||Provides a list of disabled, inactive users by name and date of disabling.
|}
|-
||'''Password Length'''
||The minimum length allowed for a password; the number inputted must be between '''6 - 32 characters.'''
|-
||'''Complexity'''
||
Set the level of character-type complexity required for a password. The options are as follows:
* '''No Restriction - '''any character can be used; this is the default.
|-
||'''Password Expiration'''
||Each user will be forced to change their password once the selected number of days has passed. Doing so every quarter or so is good security practice; however, any number of days can be set. On each login, the system will check how many days until the password expires and will notify the user their password is about to expire in X days.
|-
||'''Password History Check'''
====Disable Inactive Accounts and Activation Settings====
Scrolling down further on the '''General '''password settings page will bring you to the sections that allow you to set the criteria for disabling and activating accounts.
[[User]] accounts can be configured to automatically become disabled after a predetermined period of inactivity. Once disabled, a [[Password Policy#Password Reset Message|password reset]] is required by the user to regain access to the system. This feature adds to the many user management options within the system.
:: [[File:Password disable and activate.png|500px|border]]
This function works with the @activationlink@ [[Password Variables to Set or Reset User Passwords|password variable]]. If the '''https://@url@@activationlink@ '''syntax is used in the '''Request Password '''section of [[Email#Email Templates for User Activation and Password|email templates]], this setting sets the duration that the activation link will be valid for the user in ''number of hours. ''
* '''Note: '''Best practice is to provide around 24 hours. Providing too little time will force you to continuously resend links as users will be more likely to forget to activate their accounts in time.
|-
<pre style="white-space: -o-pre-wrap; word-wrap: break-word;"><!--@sslogic('@langid@'='2')--><br>@system.Password Policy - French@<!--@else--><br>@system.Password Policy@<!--@end--></pre>
===Intruder Lockout Settings and Intruder Email Alert Alert===
The third tab in '''Password and Activation Policies, '''called '''Intruder Alert Settings, '''will determine the actions that should be taken if someone attempts to log into your copy of [[SmartSimple]] but cannot provide accurate credentials.
|-
||'''Subject'''
||The subject of the email. See
|-
||'''Body'''
||'''Sample Template - '''Clicking this will populate the text window automatically with a template of what the email alert will contain. It will include [[System Variables]].
|}
'''Intruder Alert Email Variables''' – because the [[User|user]] is not logged into the system, the amount of information available is limited to IP Address '''@ip@''', the attempted username '''@username@''' and date/time '''@now@''' of the attempted login.
===Locked Users===
The '''Locked Users '''tab will display a [[List View Overview|list]] of all users that have had their account locked.
* '''Lockout Message''' - a custom message to display to users when a :: [[File:Locked user is locked out due to too many failed login attemptslists. This message will only display when a user has been locked out, and attempts to log in again with the correct password. Therefore, no information will be divulged to users that fail their login. * The '''View Locked Users''' tab will display all [[Userpng|800px|usersborder]] that have had their account locked. * If a user is locked, you can click on the the '''Set Password''' button on the '''View Locked Users''' tab to reactivate the account and send the [[User|user]] a new [[Password|password]]. * ''Once an account has been locked for exceeding the number of permitted login attempts it will remain on the "locked users" list until the correct password is entered. This allows the administrator to see which users have been unable to log in, even if the configured lockout duration has passed and the account is no longer technically locked.'' * ''When an account has been locked for exceeding the allotted number of attempts, after the lockout time has passed they are permitted only one attempt at the correct password. A single incorrect password at this point will re-lock the account for the configured lockout duration. In other words, once someone is on the "locked user" list they are only permitted a single wrong attempt and they will be locked for the lockout duration again. This prevents would-be intruders from having multiple attempts to guess the password each time the lockout duration has passed.'' ===Intruder Email Alert===These settings define who should be informed by email if an intruder alert is detected. A default emial template is used and contains the following values: The Default template uses the primary contact on the root company record to populate the '''Email To'''. You can save the default template and then modify ifrequired. * '''Email From''' – the “from” address for the email. If you do not set this value, the address: '''donotreply@smartsimple.com''' will be used.* '''Email To''' – select the [[Internal|internal]] people to receive the email.* '''Subject''' – the subject of the email. See below for the variables that you can use in the subject.* '''Body''' – the body of the alert email. See below for the variables that you can use in the body. '''Intruder Alert Email Variables''' – because the [[User|user]] is not logged into the system, the amount of information available is limited to IP Address '''@ip@''', the attempted username '''@username@''' and date/time '''@now@''' of the attempted login. ===Intruder Log===The '''View Log''' tab is used to access the '''Intruder Alert''' log. [[Image:Glob13.png]] * The list can be sorted by clicking the column title.* You can filter the list by [[Username|username]], year, and month. ===Hierarchical Password Policy===When viewing a company in your hierarchy, select '''Settings > Password Policy''' to define. <br/><br/> A different password policy can be defined for each company within the system. <br/><br/> If there are password policies defined for a company then it will automatically apply to all sub-companies in the [[Creating_an_Organization_Chart_and_Company_Hierarchy|hierarchy]], unless those sub-companies have defined their own password policy. <br/><br/> If there are no password policies defined for a company, then the system will look at the companies above it in the hierarchy, and if one of these parent companies have a password policy set then it will use these settings. <br/><br/> If there are no password policies defined for a company, or any of the companies above it in the hierarchy, then the password policy set in [[Global_Settings|Global Settings]] will apply.<br/><br/> ''NOTE:'' There are no settings stored in the database for a company until someone actually opens the Password Policy page for that company and clicks Save. ==View Locked Users==This option is only available from the Password Policy button on the [[Category:Global Settings|Global settings]]. It cannot be accessed for the individual Password policies for the different companies in your organizations hierarchy. [[Image:ViewLockedUsers.png|1000px]] The the '''View Locked Users''' tab will display all [[User|users]] that have had their account locked. * Once an account has been locked for exceeding the number of permitted login attempts it will remain on the "locked users" list until the correct password is entered. This allows the administrator to see which users have been unable to log in, even if the configured lockout duration has passed and the account is no longer technically locked. * When an account has been locked for exceeding the alloted number of attempts, after the lockout time has passed they are permitted only one attempt at the correct password. A single incorrect password at this point will re-lock the account for the configured lockout duration. In other words, once someone is on the "locked user" list they are only permitted a single wrong attempt and they will be locked for the lockout duration again. This prevent would-be intruders from having multiple attempts to guess the password each time the lockout duration has passed. * If a user is locked, you can click on the '''Set Password''' button tab to reactivate the account and send the the [[User|user]] a new a new [[Password|password]].
Once an account has been locked for exceeding the number of permitted login attempts, it will remain on the '''Locked Users '''list until the correct password is entered. This allows the SysAdmin to see which users have been unable to log in, even if the configured lockout duration has passed and the account is no longer technically locked.
==View Expired Users==This option is only available from When an account has been locked for exceeding the Password Policy on number of permitted login attempts, after the [[Category:Global Settings|Global settings]]. It can not be accessed for the individual Password policies for lockout time has passed they are permitted only ''ONE ''attempt at the different companies in your organizations hierarchycorrect password.
[[Image:ViewExpiredUsers* A single incorrect password at this point will '''re-lock '''the account for the configured lockout duration.png|1000px]] * This is a preventative measure so that would-be intruders do not have multiple attempts to guess the password each time the lockout duration has passed.
* The ===Disabled Inactive Users===This function is only available from '''View Expired UsersGlobal Settings > Security > Password and Activation Policies; ''' tab will display all it is not accessible from individual password policies for the different companies in your [[UserOrganization hierarchy|usersorganization hierarchy]] that had their accounts disabled due to [[Password_Policy#Section_1:_Persistent_Login_and_Expiration_of_Inactive_Accounts|inactivity]]. There will be page navigation options if there is an overly long list.
* Once an account has been expired for having been :: [[File:Disabled inactive for longer that users.png|800px|border]] Similarly to the permitted number '''Locked Users '''tab, the '''Disabled Inactive ''''''Users '''tab will provide a [[List View Overview|list]] of days it will remain on the "all expired [[User|users" list until their password is reset]] in your system. This allows the administrator to see which users Their accounts have been expiredas a result of inactivity and a disabling that can be configured after a certain amount of time (see [[Password Policy#Disable Inactive Accounts and Activation Settings|Disable Inactive Accounts]].
* Once an account has been disabled as a result of overly long inactivity, the user will remain on this list until their password is reset. This allows the SysAdmin to see which users have had their accounts disabled because of inactivity.* If a an inactive user is expireddisabled, you can click on the there will be a '''Send PasswordPassword ''' button next to reactivate their name on this tab - that way, you can reactive the account and send the [[User|user]] a new [[Password|password]]with which they can log into the system.
==Single Sign-On==
