Smartstaff, administrator
60
edits
Changes
no edit summary
==Overview=='''Password PolicyPolicy ''' is used to control configure the length and complexity of passwords, password expiration and history, the number of retries that the policies within [[User|userSmartSimple]] with your organizational standards. It is allowedbest practice to ensure that these policies match the other systems deployed by your organization; consequently, and the lockout time these policies allow for the account if they exceed the number of retriesextensive configuration options.
Multiple password policies can be supported by the system. This feature provides for less stringent policies for types of users that ''infrequently 'Maximum Password Update in 24 Hours''' – The maximum number of access the system - for example, [[External]] contacts who would only use the system for an application. Alternative password changes a user can make within a 24 hour period policies can be defined. This is to prevent users bypassing set for any level in the password history restriction by changing their password repeatedly to return to a previously used password[[Organization hierarchy|organization hierarchy]].
You can also set individual password policies for the different companies of your organization hierarchy. However, they will be able to ''edit 'Password length''' – the minimum length allowed policy only, and not edit the [[Email#Email Templates for User Activation and Password|the Activation Emails]], which can only be configured from [[Global Settings]] by a [[PasswordUser|user]] with [[Global User Administrator|System Administrator]] [[User Role|passwordprivileges]], between 6 and 32 characters.
: '''ComplexityNote: ''' – the level In all cases of complexity required in the [[Password|password]]policies, the options are:* '''No Restrictioncommon words ''' – any character can be used. This is the default.* or '''Alpha Onlyknown common passwords ''' – only letters can are ineligible to be usedas [[SmartSimple]] passwords. ==Configuration - Essentials==* '''Alpha & Numeric''' – letters and numbers must be used in ===How to Access the password.Password Settings===* '''Alpha & Numeric & Special characters''' – letters, numbers and special characters must be used1.* '''Custom Policy''' Click on the 9- a password policy can be custom definedsquare menu icon on the top right of your page.
:: {{Icon-Menu}}
2. Under the heading '''Configuration, '''select '''[[Global Settings]]. '''
3. Click on the tab labelled '''Security.'''
4. Click on the hyperlink called '''Password and Activation Policies.'''
A page displayed with numerous settings and tabs related to your system's password and activation policies will appear. On this page, you can modify the required complexities of passwords, email templates for activating users and setting passwords, disable inactive accounts, and more.
:: [[File:General password activation policies.png|900px|border]]
{| class="wikitable"
|-
||'''Tab Name'''
||'''Overview of Features and Functionality'''
|-
||'''[[Password Policy#Password Settings|General]]'''
||Provides access to modify, configure, or enable/disable general password settings, the deactivation of inactive accounts, activation settings, password reset messages, and persistent login.
|-
||'''[[Email#Email Templates for User Activation and Password|Activation Email Templates]]'''
||Allows modification and configuration of Email Templates for the following functions: New User, Request Password, and Password Change Notification. Can also set a default language and From Address.
|-
||'''[[Password Policy#Intruder Lockout Settings and Intruder Email Alert|Intruder Alert Settings]]'''
||Allows modification of intruder settings, including the amount of retries, the lockout duration, and the content for an email alert when there is an intrusion.
|-
||'''[[Login Page#Invalid Login Audit|Invalid Login Audit]]'''
||Provides a [[List View Overview|list]] of invalid logins by username, IP Address, and time for auditing and record-keeping purposes.
|-
||'''[[Password Policy#View Locked Users|Locked Users]]'''
||Provides a list of locked users by name, Lockout Time, and the feature to directly set that user with a new password.
|-
||'''[[Disable User Account After Inactive Period|Disabled Inactive Users]]'''
||Provides a list of disabled, inactive users by name and date of disabling.
|}
===Password Encryption===
For your information, if necessary:
{{PasswordEncryption}}
===Password Settings===
This section, under the first tab of the '''Password and Activation Policies '''labelled '''General, '''is used to set password attributes.
:: [[File:General password settings.png|400px|border]]
{| class="wikitable"
|-
||'''Password Length'''
||The minimum length allowed for a password; the number inputted must be between '''6 - 32 characters.'''
|-
||'''Complexity'''
||
Set the level of character-type complexity required for a password. The options are as follows:
* '''No Restriction - '''any character can be used; this is the default.
* '''Alpha Only - '''only letters are able to be used.
* '''Alpha & Numeric - '''both letters and numbers must be used in the password.
* '''Alpha & Numeric & Special Characters - '''a combination of letters, numbers, and special characters must be used.
* '''Custom Policy - '''a password policy can be custom-defined.
'''Disable Restriction of Common Passwords - '''Toggling on this function will then ''enable ''the user's ability to use common passwords as their password. This is not recommended for security reasons, as common passwords are easier to guess and to enable security breaches.
|-
||'''Force Password Change'''
||
'''Force New Password on First Login - '''This will ensure that each individual user will be forced to change their password from a system-generated or SysAdmin-determined password into one of their own accord.
* '''Note: '''This first login does not count towards the Maximum Password Update in 24 Hours setting.
'''Important:Expire All Passwords Now - ''' When defining This is a custom password policy be sure to provide a detailed description of the policy handy button that will immediately invalidate all passwords in the '''Custom Password Policy Description''' field so system, ensuring that users are aware each user will have to reset their passwords when they next log in. A good use-case of the minimum requirement this function might be if you updated your password policy to enable them require more complex passwords; by expiring all passwords, every user in your system will have to create a valid new passwords that fall under the new passwordcriteria.
* This setting only pertains to password changes by use of '''Update Password '''by the user - it is not relevant to the '''Forgot Password '''link nor to the [[Global User Administrator|System Administrators]] ability to '''Set Password '''for users.
|-
||'''Password Data Restriction'''
||
Configuring this setting will restrict password settings so that values such as first name, last name, or organization name ''cannot ''be used in the password. Any number of fields can be selected from both the '''Organization '''or the '''Contact '''[[Profile]].
|}====New Password Disable Inactive Accounts and Activation Settings==== * Scrolling down further on the '''Force New Password on First LoginGeneral ''' - Ensures password settings page will bring you to the sections that allow you to set the user selects a password of their own choosing the first time they log into [[SmartSimple]]criteria for disabling and activating accounts.
'''Note: '''This is applicable when an organization has a [[The Root Company|root organization]], and one or more sub-companies each with its own password policies.
|-||'''Default Security Code'''||This is a hard-coded value to be entered when users request new passwords. For example, 12345. |-||'''Challenge Questions, delimited by semi-colons'''||You can set a series of challenge questions through which all users will be prompted to select one upon next login. Their answer to that question will be stored in the system, and if they forget their password, they will be prompted to enter this answer and click the activation link in the '''Forgot Password '''[[Image:Email#Email Templates for User Activation and Password-Activation-Settings.png|email template]].
* '''Default Security CodeNote: ''' - The best challenge questions will have answers that are simple, memorable, not easy to guess, and will not change over time.
:: [[ImageFile:Challenge-questionPassword reset message custom.png|800px|border]] In the text field box, write the content for the '''Reset Password '''message that a user will see if they need to reset their password. You may select between a default template or you may choose to make it custom.
====Persistent Login====:: [[File:Persistent login.png|600px|border]] The '''Note:Persistent Login''' An example functionality provides for the use of a good challenge question would persistent secure cookie on the [[SmartSimple]] [[User|user]]'s computer to eliminate the need to use a username and password to log into the system. Rather than having to log in to SmartSimple each time you open your web browser, a "cookie" can be something installed on your computer that is simplewill automatically authenticate you, memorableallowing you to bypass the login screen. (This setting can be [[System_Security_Permissions#Miscellaneous_Feature_Permission|enabled or disabled]] by your system administrator). In order for this feature to work, canyou must have the user't s browser enabled to accept persistent cookies.====Rules for Password Activation Settings====When an organization has their password settings configured, then they will be guessed easily, and won't change over timeused in full.
When an organization does not have their password settings configured, the system will go up the [[Organization hierarchy|organization hierarchy]] until it finds a parent company with password settings configured, and by default it will allow the organization to inherit those settings. '''Example: '''If only the [[The Root Company|root organization]] has its password settings configured, all other organizations would inherit the same policies, as they all fall under the root organization on the organization hierarchy.
|-||For when an existing user requests a new password||* If the password activation settings have a '''Lockout Durationdefault security code ''' – but no challenge questions, the duration of user will be prompted to enter the account lockoutdefault security code. The [[User| * If the password activation settings have a '''default security ''''''code '''and '''challenge questions, '''the user]] will not only be able prompted to log in during this periodanswer a challenge question. Period can * The user will be set to 5 minutes, 15 minutes, 30 minutes, 1 hour, 3 hours, 12 hours, 24 hours or forever (until unlocked by [[Administrator|administrator]])presented with reCAPTCHA validation in all cases.
====Custom Policy====* If a user is lockedThe '''Compose Custom Password Policy''' table provides the ability to define the custom password policy that matches your organization's security standards and provides control of each character type desired (upper case, lower case, you numeric and/or symbols). You can click on also specify the minimum number of characters required for that character type.* The character mask used to define your selection will appear in the '''Set Custom PasswordPolicy''' field. You can also write your own code and paste it into this field if desired.* The '''Validate Pattern''' button on will open a window where you can test various passwords against the policy to see if they will pass or fail.* The value in the '''View Locked UsersCustom Password Policy Description''' tab field will be displayed to reactivate the account and send the users when setting/changing their password. You can use plain text or html in this field (For example, to insert a line break use ''<br>'')* '''Note''': See also [[User|userCustom Password Policy Examples]] a new [[Password|passwordImage:Custpwpolicy.png]].
'''Important:''' When defining a custom password policy be sure to provide a detailed description of the policy in the '''Custom Password Policy Description''' field so that users are aware of the minimum requirement to enable them to create a valid password.
:: [[File:Intruder alert settings new.png|600px|border]]
{| class="wikitable"
|-
||'''Number of Attempts'''
||Enter a number from 1-32 that will denote the amount of times someone can ''attempt ''to log in with an account (that is, with an incorrect password) before that account is locked.
|-
||'''Lockout Duration'''
||
Select from a number of options the duration of the account lockout. Within this period, the user will have no ability to log in, even if their credentials are correct.
{| class="wikitable"|-||'''Intruder Alert Email VariablesFrom''' – because ||The From Address for the [[User|user]] in email alert. If you do not logged into the system manually set this value, then the amount of information available is limited to IP Address address '''donotreply@ip@smartsimple.com ''', the attempted username will be used.|-||'''@username@Email To''' and time ||Select the [[Internal]] people to receive the email alert. Click the '''@time@binoculars icon '''for a full list of internal staff, from which you can select who to send the email alert to.
* '''Note: '''The Default Template will use the [[Organization hierarchy#Organization Ownership|primary contact]] of the [[The Root Company|root organization]] to populate the '''Email To '''field.
:: [[ImageFile:Glob13Locked user lists.png|800px|border]]If a user is locked, you can click on the '''Set Password''' button on the '''View Locked Users''' tab to reactivate the account and send the [[User|user]] a new [[Password|password]].
When an account has been locked for exceeding the number of permitted login attempts, after the lockout time has passed they are permitted only ''ONE ''attempt at the correct password.
* Once an account has been disabled as a result of overly long inactivity, the user will remain on this list until their password is reset. This allows the SysAdmin to see which users have had their accounts disabled because of inactivity.* If a an inactive user is lockeddisabled, you can click on the there will be a '''Set PasswordSend Password ''' button next to reactivate their name on this tab - that way, you can reactive the account and send the [[User|user]] a new [[Password|password]]with which they can log into the system.
==Single Sign-On==
For information on the Single Sign-On settings and functionality, please refer to the [[Single Sign-On]] page.
* [[Custom Password Policy Examples]]
* [[Password Variables to Set or Reset User Passwords]]
[[Category:Global Settings]][[Category:Security]][[Category:System Auditing]]
