Changes

==Overview=='''Password PolicyPolicy ''' is used to control configure the length and complexity of passwords, password expiration and history, the number of retries that the policies within [[User|userSmartSimple]] with your organizational standards. It is allowedbest practice to ensure that these policies match the other systems deployed by your organization; consequently, and the lockout time these policies allow for the account if they exceed the number of retriesextensive configuration options. 

=='''Password Length and Complexity==Policies include the following:'''

You can also set individual password policies for the different companies of your organization hierarchy. However, they will be able to ''edit 'Maximum 'the policy only, and not edit the [[Email#Email Templates for User Activation and Password Update in 24 Hours''' – The maximum number of password changes a user can make within a 24 hour period |the Activation Emails]], which can only be defined. This is to prevent users bypassing the password history restriction configured from [[Global Settings]] by changing their password repeatedly to return to a previously used password[[User|user]] with [[Global User Administrator|System Administrator]] [[User Role|privileges]]. 

: '''Password lengthNote: '''In all cases of password policies, '''common words '''or '''known common passwords ''' – the minimum length allowed for a are ineligible to be used as [[Password|passwordSmartSimple]], between 6 and 32 characterspasswords. ==Configuration - Essentials=====How to Access the Password Settings===1. Click on the 9-square menu icon on the top right of your page.

'''Complexity''' – the level of complexity required in the [[Password|password]], the options are:: {{Icon-Menu}} * '''No Restriction''' – any character can be used2. This is Under the default.* heading '''Alpha OnlyConfiguration, ''' – only letters can be used.* select '''Alpha & Numeric''' – letters and numbers must be used in the password[[Global Settings]].*  '''Alpha & Numeric & Special characters''' – letters, numbers and special characters must be used.* '''Custom Policy''' - a password policy can be custom defined.

4. Click on the hyperlink called '''Password and Activation Policies.''' A page displayed with numerous settings and tabs related to your system's password and activation policies will appear. On this page, you can modify the required complexities of passwords, email templates for activating users and setting passwords, disable inactive accounts, and more.  :: [[File:General password activation policies.png|900px|border]] {| class===Custom Policy==="wikitable"|-||'''Tab Name'''||'''Overview of Features and Functionality'''|-* The ||'''Compose Custom [[Password Policy#Password Settings|General]]''' table allows you ||Provides access to define modify, configure, or enable/disable general password settings, the custom deactivation of inactive accounts, activation settings, password policy reset messages, and persistent login.|-||'''[[Email#Email Templates for User Activation and Password|Activation Email Templates]]'''||Allows modification and configuration of Email Templates for the following functions: New User, Request Password, and Password Change Notification. Can also set a default language and From Address. |-||'''[[Password Policy#Intruder Lockout Settings and Intruder Email Alert|Intruder Alert Settings]]'''||Allows modification of intruder settings, including the amount of retries, the lockout duration, and the content for an email alert when there is an intrusion.|-||'''[[Login Page#Invalid Login Audit|Invalid Login Audit]]'''||Provides a [[List View Overview|list]] of invalid logins by username, IP Address, and time for auditing and record-keeping purposes.|-||'''[[Password Policy#View Locked Users|Locked Users]]'''||Provides a list of locked users by enabling each character set desired (upper casename, lower caseLockout Time, numeric and/or symbols) the feature to directly set that user with a new password. |-||'''[[Disable User Account After Inactive Period|Disabled Inactive Users]]'''||Provides a list of disabled, inactive users by name and specifying date of disabling. |}===Password Encryption===For your information, if necessary:  {{PasswordEncryption}} ===Password Settings===This section, under the first tab of the '''Password and Activation Policies '''labelled '''General, '''is used to set password attributes.  :: [[File:General password settings.png|400px|border]]{| class="wikitable"|-||'''Password Length'''||The minimum length allowed for a password; the number inputted must be between '''6 - 32 characters.'''|-||'''Complexity'''||Set the level of characters character-type complexity required for that a password. The options are as follows:  * '''No Restriction - '''any character setcan be used; this is the default. * '''Alpha Only - '''only letters are able to be used. * The system code '''Alpha & Numeric - '''both letters and numbers must be used to enforce your selection will appear in the password.* '''Alpha & Numeric & Special Characters - '''a combination of letters, numbers, and special characters must be used. * '''Custom Password Policy- ''' field. You a password policy can also write your own code and paste it into this field if desiredbe custom-defined.  * The '''Validate PatternDisable Restriction of Common Passwords - ''' button Toggling on this function will open a window where you can test various then ''enable ''the user's ability to use common passwords as their password. This is not recommended for security reasons, as common passwords against the policy are easier to guess and to see if they will pass or failenable security breaches.   |-||'''Force Password Change'''||* The value in the '''Custom Force New Password Policy Descriptionon First Login - ''' field This will ensure that each individual user will be displayed forced to users when setting/changing change their passwordfrom a system-generated or SysAdmin-determined password into one of their own accord. You can use plain text or html in this field (For example, to insert a line break use   * '''Note: '<br>'')This first login does not count towards the Maximum Password Update in 24 Hours setting. 

'''Important:Expire All Passwords Now - ''' When defining This is a custom password policy be sure to provide a detailed description of the policy handy button that will immediately invalidate all passwords in the '''Custom Password Policy Description''' field so system, ensuring that users are aware each user will have to reset their passwords when they next log in. A good use-case of the minimum requirement this function might be if you updated your password policy to enable them require more complex passwords; by expiring all passwords, every user in your system will have to create a valid new passwords that fall under the new passwordcriteria. 

If you need to translate the |-||'''Custom Password Policy DescriptionExpiration''' message you ||Each user will be forced to change their password once the selected number of days has passed. Doing so every quarter or so is good security practice; however, any number of days can use [[sslogic]]be set. It  On each login, the system will check how many days until the password expires and will notify the user their password is often easiest about to use [[System Variables]] for theseexpire in X days. Example: <!|--@sslogic(||''@langid@'=Password History Check'2''||You can set the number of previous passports (to a maximum of 32)--><br>@that the systemwill remember for each user.When changing their password, users will not be permitted to re-use a previous password that is remembered by the '''Password Policy History '''until the specified number of unique passwords have been used. |- French@<!||'''Maximum Password Changes in 24 Hours'''||This will set the maximum number of password changes any individual user is able to make within a 24--@else--><br>@systemhour period. This is to prevent users from bypassing the password history restriction by changing their password repeatedly in order to return to a previously used password.Password Policy@<!--@end-->

===Hierarchical |-||'''Password Policy===Data Restriction'''||Configuring this setting will restrict password settings so that values such as first name, last name, or organization name ''cannot ''be used in the password. Any number of fields can be selected from both the '''Organization '''or the '''Contact '''[[Profile]]. 

A different password policy can be defined for each company which will automatically apply to all sub'''Organization Field '''-companies in the Both [[Creating_an_Organization_Chart_and_Company_HierarchyStandard Fields|hierarchystandard]], unless they have defined their own password policy. When viewing a company in your hierarchy, select '''Settings > Password Policy''' to define. If there are no password policies defined for a company or the companies above it in the hierarchy, the password policy set in and [[Global_SettingsCustom Fields|Global Settingscustom fields]] will applyare supported. 

|}====New Password Disable Inactive Accounts and Activation Settings==== * Scrolling down further on the '''Force New Password on First LoginGeneral ''' - Ensures password settings page will bring you to the sections that allow you to set the user selects a password of their own choosing the first time they log into [[SmartSimple]]criteria for disabling and activating accounts. 

* '''[[User]] accounts can be configured to automatically become disabled after a predetermined period of inactivity. Once disabled, a [[Password Policy#Password Expiration''' - Each Reset Message|password reset]] is required by the user will be forced to change their password once regain access to the selected number of days has passedsystem. Any number of days can be setThis feature adds to the many user management options within the system.

* :: [[File:Password disable and activate.png|500px|border]]{| class="wikitable"|-||'''Disable user accounts after ''X ''Password History Checkdays''' - You can set ||Insert the number of previous passwords (to days a maximum of 32) that the system will remember for each useraccount is inactive before it is disabled. When changing their passwordIn order to disable this feature, users will not be permitted simply leave the field blank.|-||'''Apply Policy to All Sub-Companies'''||Click this button to reforce-use a previous update the password until policy related to the specified number of unique passwords have been usedcurrent organization and all sub-companies.  

==|-||'''Disabled Inactive Account Message'''||Write in the text that will be displayed when a user is attempting to access an expired account.|-||'''Enable reCAPTCHA Validation'''|||-||'''Activation link life span'''||This function works with the @activationlink@ [[Password Variables to Set or Reset User Passwords|password variable]]. If the '''https://@url@@activationlink@ '''syntax is used in the '''Request Password '''section of [[Email#Email Templates for User Activation Settings==and Password|email templates]], this setting sets the duration that the activation link will be valid for the user in ''number of hours. ''

Password Activation Settings* '''Note: '''Best practice is to provide around 24 hours.Providing too little time will force you to continuously resend links as users will be more likely to forget to activate their accounts in time. 

|-||'''Default Security Code'''||This is a hard-coded value to be entered when users request new passwords.  For example, 12345. |-||'''Challenge Questions, delimited by semi-colons'''||You can set a series of challenge questions through which all users will be prompted to select one upon next login. Their answer to that question will be stored in the system, and if they forget their password, they will be prompted to enter this answer and click the activation link in the '''Forgot Password '''[[Image:Email#Email Templates for User Activation and Password-Activation-Settings.png|email template]]. 

* '''Default Security CodeNote: ''' - The best challenge questions will have answers that are simple, memorable, not easy to guess, and will not change over time. 

* '''Activation link life span''' - The duration that the activation link will be valid. The activation link variable can be used in the "Forgot password" email template using the following syntax: '''httpExample of Challenge Questions://@url@@activationlink@ '''

* : ''In what city or town was your first job?;'Challenge Questions, delimited by semi-colons'<br />'' - You can set a series What is your mother's maiden name?;''<br />''What was your first pet's name?;''<br />''In what year was your father born? ''|}====Password Reset Message====Even further down at the bottom of challenge questions, all users will be prompted to select a Challenge Question on next login. Their answer will be stored the '''General '''page of '''Password and they will be prompted Activation Policies '''are features relating to enter this answer if they forget their password and click the activation link in the "Forgot password" email templatea '''Password Reset Message '''and '''Persistent Login. '''

:: [[ImageFile:Challenge-questionPassword reset message custom.png|800px|border]] In the text field box, write the content for the '''Reset Password '''message that a user will see if they need to reset their password. You may select between a default template or you may choose to make it custom. 

====Persistent Login====:: [[File:Persistent login.png|600px|border]] The '''Note:Persistent Login''' An example functionality provides for the use of a good challenge question would persistent secure cookie on the [[SmartSimple]] [[User|user]]'s computer to eliminate the need to use a username and password to log into the system. Rather than having to log in to SmartSimple each time you open your web browser, a "cookie" can be something installed on your computer that is simplewill automatically authenticate you, memorableallowing you to bypass the login screen. (This setting can be [[System_Security_Permissions#Miscellaneous_Feature_Permission|enabled or disabled]] by your system administrator). In order for this feature to work, canyou must have the user't s browser enabled to accept persistent cookies.====Rules for Password Activation Settings====When an organization has their password settings configured, then they will be guessed easily, and won't change over timeused in full.

These {| class="wikitable"|-||For when a new user is sent their password for the first time||* If the password activation settings determine have a '''default security code '''but no challenge questions, the actions that should user will be prompted to enter the default security code. * If the password activation settings have a '''default security code '''and '''challenge questions, '''the user will be prompted to enter the default security code and then taken if someone attempts to log into your copy a second screen to define an answer to one of the challenge questions. The user can then go their [[SmartSimpleProfile]].* and access the '''Number of AttemptsChange Password ''' – the number of attempts page to log view and update their stored challenge question and answer.* The user will be presented with reCAPTCHA validation in with an account before the account is lockedall cases.

|-||For when an existing user requests a new password||* If the password activation settings have a '''Lockout Durationdefault security code ''' – but no challenge questions, the duration of user will be prompted to enter the account lockoutdefault security code. The [[User| * If the password activation settings have a '''default security ''''''code '''and '''challenge questions, '''the user]] will not only be able prompted to log in during this periodanswer a challenge question. Period can * The user will be set to 5 minutes, 15 minutes, 30 minutes, 1 hour, 3 hours, 12 hours, 24 hours or forever (until unlocked by [[Administrator|administrator]])presented with reCAPTCHA validation in all cases. 

* The '''View Locked Users''' tab |}After a user has successfully completed the appropriate password activation process, they will display all be logged into that SmartSimple [[User|usersinstance]] that have had and their account lockednewly created password will become active. <br> 

====Custom Policy====* If a user is lockedThe '''Compose Custom Password Policy''' table provides the ability to define the custom password policy that matches your organization's security standards and provides control of each character type desired (upper case, lower case, you numeric and/or symbols). You can click on also specify the minimum number of characters required for that character type.* The character mask used to define your selection will appear in the '''Set Custom PasswordPolicy''' field. You can also write your own code and paste it into this field if desired.* The '''Validate Pattern''' button on will open a window where you can test various passwords against the policy to see if they will pass or fail.* The value in the '''View Locked UsersCustom Password Policy Description''' tab field will be displayed to users when setting/changing their password. You can use plain text or html in this field (For example, to reactivate the account and send the insert a line break use ''&lt;br>'')* '''Note''': See also [[User|userCustom Password Policy Examples]] a new [[Image:Custpwpolicy.png]] '''Important:''' When defining a custom password policy be sure to provide a detailed description of the policy in the '''Custom Password|Policy Description''' field so that users are aware of the minimum requirement to enable them to create a valid password]].

* <pre style="white-space: -o-pre-wrap; word-wrap: break-word;">&lt;!--@sslogic('@langid@'='2'Once an account has been locked for exceeding )-->&lt;br>@system.Password Policy - French@&lt;!--@else-->&lt;br>@system.Password Policy@&lt;!--@end--></pre>===Intruder Lockout Settings and Intruder Email Alert===The third tab in '''Password and Activation Policies, '''called '''Intruder Alert Settings, '''will determine the number of permitted login actions that should be taken if someone attempts it will remain on the "locked users" list until the correct password is entered. This allows the administrator to see which users have been unable to log in, even if the configured lockout duration has passed and the account is no longer technically lockedinto your copy of [[SmartSimple]] but cannot provide accurate credentials.''

* :: [[File:Intruder alert settings new.png|600px|border]]{| class="wikitable"|-||''When 'Number of Attempts'''||Enter a number from 1-32 that will denote the amount of times someone can ''attempt ''to log in with an account (that is, with an incorrect password) before that account has been is locked for exceeding the alloted . |-||'''Lockout Duration'''||Select from a number of attempts, after options the lockout time has passed they are permitted only one attempt at the correct password. A single incorrect password at this point will re-lock duration of the account for the configured lockout duration. In other wordsWithin this period, once someone is on the "locked user" list they are only permitted a single wrong attempt and they will be locked for the lockout duration again. This prevent would-be intruders from having multiple attempts have no ability to guess the password each time the lockout duration has passedlog in, even if their credentials are correct. '' 

==|}The latter half of this page has the heading '''Intruder Email Alert==- '''using a default template, it allows you to customize the email alert when someone has been locked out because of intruding attempts. 

These settings define who should be informed by email if an intruder alert is detected.{| class="wikitable"|-* ||'''Email From''' – the “from” address ||The From Address for the emailalert. If you do not manually set this value, then the address: address '''supportdonotreply@smartsimple.comcom ''' will be used.* |-||'''Email To''' – select ||Select the [[Internal|internal]] person people to receive the emailalert.* Click the '''Subjectbinoculars icon ''' – the subject for a full list of the email. See below for the variables that internal staff, from which you can use in the subject.* '''Body''' – the body of select who to send the email alert email. See below for the variables that you can use in the bodyto.

* '''Intruder Alert Email VariablesNote: ''' – because The Default Template will use the [[UserOrganization hierarchy#Organization Ownership|userprimary contact]] in not logged into of the system the amount of information available is limited [[The Root Company|root organization]] to IP Address populate the '''@ip@''', the attempted username '''@username@''' and time '''@time@Email To '''field. 

==Intruder Log=Locked Users===The '''Locked Users '''tab will display a [[List View Overview|list]] of all users that have had their account locked. 

The :: [[File:Locked user lists.png|800px|border]]If a user is locked, you can click on the '''View LogSet Password''' tab is used to access the  button on the '''Intruder AlertView Locked Users''' log tab to reactivate the account and send the [[User|user]] a new [[Password|password]].

[[Image:Glob13Once an account has been locked for exceeding the number of permitted login attempts, it will remain on the '''Locked Users '''list until the correct password is entered. This allows the SysAdmin to see which users have been unable to log in, even if the configured lockout duration has passed and the account is no longer technically locked.png]]

* The list can be sorted by clicking When an account has been locked for exceeding the column title.* You can filter number of permitted login attempts, after the lockout time has passed they are permitted only ''ONE ''attempt at the list by [[Username|username]], year, and monthcorrect password. 

==View Locked =Disabled Inactive Users===This function is only available from '''Global Settings > Security > Password and Activation Policies; '''it is not accessible from individual password policies for the different companies in your [[Organization hierarchy|organization hierarchy]]. 

The :: [[File:Disabled inactive users.png|800px|border]] Similarly to the '''View Locked UsersUsers '''tab, the '''Disabled Inactive ''''''Users ''' tab will display provide a [[List View Overview|list]] of all expired [[User|users]] in your system. Their accounts have expired as a result of inactivity and a disabling that have had their account locked. <br>* Once an account has been locked for exceeding the number can be configured after a certain amount of permitted login attempts it will remain on the "locked users" list until the correct password is entered. This allows the administrator to time (see which users have been unable to log in, even if the configured lockout duration has passed [[Password Policy#Disable Inactive Accounts and the account is no longer technically lockedActivation Settings|Disable Inactive Accounts]].

* When Once an account has been locked for exceeding the alloted number disabled as a result of attemptsoverly long inactivity, after the lockout time has passed they are permitted only one attempt at user will remain on this list until their password is reset. This allows the correct passwordSysAdmin to see which users have had their accounts disabled because of inactivity. A single incorrect password at * If an inactive user is disabled, there will be a '''Send Password '''button next to their name on this point will retab -lock that way, you can reactive the account for the configured lockout duration. In other words, once someone is on and send the "locked user" list they are only permitted a single wrong attempt and new password with which they will be locked for the lockout duration again. This prevent would-be intruders from having multiple attempts to guess the password each time can log into the lockout duration has passedsystem.

* If a user is locked, you can click ==Single Sign-On==For information on the '''Set Password''' button Single Sign-On settings and functionality, please refer to reactivate the account and send the [[User|user]] a new [[Password|passwordSingle Sign-On]]page.