Changes

'''Password PolicyPolicies include the following:''' is used to control the length and complexity of passwords, password expiration and history, the number of retries that the [[User|user]] is allowed, and the lockout time for the account if they exceed the number of retries.

You can also set individual password policies for the different companies of your organization hierarchy. However, they will be able to ''edit 'Maximum 'the policy only, and not edit the [[Email#Email Templates for User Activation and Password Update in 24 Hours''' – The maximum number of password changes a user can make within a 24 hour period |the Activation Emails]], which can only be defined. This is to prevent users bypassing the password history restriction configured from [[Global Settings]] by changing their password repeatedly to return to a previously used password[[User|user]] with [[Global User Administrator|System Administrator]] [[User Role|privileges]]. 

: '''Password lengthNote: '''In all cases of password policies, '''common words '''or '''known common passwords ''' – the minimum length allowed for a are ineligible to be used as [[Password|passwordSmartSimple]], between 6 and 32 characterspasswords. ==Configuration - Essentials=====How to Access the Password Settings===1. Click on the 9-square menu icon on the top right of your page.

'''Complexity''' – the level of complexity required in the [[Password|password]], the options are:: {{Icon-Menu}} * '''No Restriction''' – any character can be used2. This is Under the default.* heading '''Alpha OnlyConfiguration, ''' – only letters can be used.* select '''Alpha & Numeric''' – letters and numbers must be used in the password[[Global Settings]].*  '''Alpha & Numeric & Special characters''' – letters, numbers and special characters must be used.* '''Custom Policy''' - a password policy can be custom defined.

3. Click on the tab labelled '''Algorithm''' – the algorithm that will be used to encrypt the passwordSecurity. The options are:* '''SHA1''' * '''SHA256'''

4. Click on the hyperlink called '''Password and Activation Policies.''' A page displayed with numerous settings and tabs related to your system's password and activation policies will appear. On this page, you can modify the required complexities of passwords, email templates for activating users and setting passwords, disable inactive accounts, and more.  :: [[File:General password activation policies.png|900px|border]] {| class===Custom Policy==="wikitable"|-||'''Tab Name'''||'''Overview of Features and Functionality'''|-* The ||'''Compose Custom [[Password Policy#Password Settings|General]]''' table allows you ||Provides access to define modify, configure, or enable/disable general password settings, the custom deactivation of inactive accounts, activation settings, password policy reset messages, and persistent login.|-||'''[[Email#Email Templates for User Activation and Password|Activation Email Templates]]'''||Allows modification and configuration of Email Templates for the following functions: New User, Request Password, and Password Change Notification. Can also set a default language and From Address. |-||'''[[Password Policy#Intruder Lockout Settings and Intruder Email Alert|Intruder Alert Settings]]'''||Allows modification of intruder settings, including the amount of retries, the lockout duration, and the content for an email alert when there is an intrusion.|-||'''[[Login Page#Invalid Login Audit|Invalid Login Audit]]'''||Provides a [[List View Overview|list]] of invalid logins by username, IP Address, and time for auditing and record-keeping purposes.|-||'''[[Password Policy#View Locked Users|Locked Users]]'''||Provides a list of locked users by enabling each character set desired (upper casename, lower caseLockout Time, numeric and/or symbols) the feature to directly set that user with a new password. |-||'''[[Disable User Account After Inactive Period|Disabled Inactive Users]]'''||Provides a list of disabled, inactive users by name and specifying date of disabling. |}===Password Encryption===For your information, if necessary:  {{PasswordEncryption}} ===Password Settings===This section, under the first tab of the '''Password and Activation Policies '''labelled '''General, '''is used to set password attributes.  :: [[File:General password settings.png|400px|border]]{| class="wikitable"|-||'''Password Length'''||The minimum length allowed for a password; the number inputted must be between '''6 - 32 characters.'''|-||'''Complexity'''||Set the level of characters character-type complexity required for that character seta password. The options are as follows:  * The system code '''No Restriction - '''any character can be used to enforce your selection will appear in ; this is the default. * '''Custom Password PolicyAlpha Only - ''' fieldonly letters are able to be used. You can also write your own code * '''Alpha & Numeric - '''both letters and paste it into this field if desirednumbers must be used in the password.* The '''Validate PatternAlpha & Numeric & Special Characters - ''' button will open a window where you can test various passwords against the policy to see if they will pass or failcombination of letters, numbers, and special characters must be used.  * The value in the '''Custom Password Policy Description- '''a password policy can be custom-defined.  '''Disable Restriction of Common Passwords - ''' field Toggling on this function will be displayed then ''enable ''the user's ability to users when setting/changing use common passwords as their password. You can use plain text or html in this field (For exampleThis is not recommended for security reasons, as common passwords are easier to insert a line break use guess and to enable security breaches.  |-||'''Force Password Change'''||'''Force New Password on First Login - '<br>'')This will ensure that each individual user will be forced to change their password from a system-generated or SysAdmin-determined password into one of their own accord.  * '''Note: ''': See also [[Custom This first login does not count towards the Maximum Password Policy Examples]]Update in 24 Hours setting.   [[Image:Custpwpolicy'''Expire All Passwords Now - '''This is a handy button that will immediately invalidate all passwords in the system, ensuring that each user will have to reset their passwords when they next log in. A good use-case of this function might be if you updated your password policy to require more complex passwords; by expiring all passwords, every user in your system will have to create new passwords that fall under the new password criteria.png]] 

|-||'''Important:Password Expiration''' When defining a custom ||Each user will be forced to change their password policy once the selected number of days has passed. Doing so every quarter or so is good security practice; however, any number of days can be sure set. On each login, the system will check how many days until the password expires and will notify the user their password is about to expire in X days.|-||'''Password History Check'''||You can set the number of previous passports (to provide a detailed description maximum of 32) that the policy in system will remember for each user. When changing their password, users will not be permitted to re-use a previous password that is remembered by the '''Password History '''until the specified number of unique passwords have been used. |-||'''Custom Maximum Password Policy DescriptionChanges in 24 Hours''' field so that ||This will set the maximum number of password changes any individual user is able to make within a 24-hour period. This is to prevent users are aware of from bypassing the minimum requirement password history restriction by changing their password repeatedly in order to enable them return to create a valid previously used password.

If you need * This setting only pertains to translate password changes by use of '''Update Password '''by the user - it is not relevant to the '''Custom Password Policy DescriptionForgot Password ''' message you can use [[sslogic]]. It is often easiest link nor to use the [[Global User Administrator|System VariablesAdministrators]] for these. Example: <!--@sslogic(ability to '''@langid@Set Password '='2')--><br>@systemfor users.Password Policy - French@<!--@else--><br>@system.Password Policy@<!--@end--> 

A different password policy can be defined for each company which will automatically apply to all sub-companies in the [[Creating_an_Organization_Chart_and_Company_Hierarchy|hierarchy]], }====Disable Inactive Accounts and Activation Settings====unless they have defined their own password policy. When viewing a company in your hierarchy, select Scrolling down further on the '''Settings > Password PolicyGeneral ''' password settings page will bring you to define. If there are no password policies defined for a company or the companies above it in sections that allow you to set the hierarchy, the password policy set in [[Global_Settings|Global Settings]] will applycriteria for disabling and activating accounts. 

==New Password Settings== * '''Force New Password on First Login''' - Ensures that the user selects [[User]] accounts can be configured to automatically become disabled after a password predetermined period of their own choosing the first time they log into inactivity. Once disabled, a [[SmartSimplePassword Policy#Password Reset Message|password reset]] is required by the user to regain access to the system. This feature adds to the many user management options within the system.

* :: [[File:Password disable and activate.png|500px|border]]{| class="wikitable"|-||'''Disable user accounts after ''X 'Password Expiration'days''' - Each user will be forced to change their password once ||Insert the selected number of days has passeda user account is inactive before it is disabled. Any number of days can be setIn order to disable this feature, simply leave the field blank.|-||'''Apply Policy to All Sub-Companies'''||Click this button to force-update the password policy related to the current organization and all sub-companies. 

* '''Password History CheckNote: ''' - You can set the number of previous passwords (to This is applicable when an organization has a maximum of 32) that the system will remember for each user. When changing their password[[The Root Company|root organization]], users will not be permitted to reand one or more sub-use a previous companies each with its own password until the specified number of unique passwords have been usedpolicies.

Password Activation Settings |-||'''Default Security Code'''||This is a hard-coded value to be entered when users request new passwords.  For example, 12345. |-||'''Challenge Questions, delimited by semi-colons'''||You can set a series of challenge questions through which all users will be set prompted to add an extra layer of security select one upon next login. Their answer to that question will be stored in the system. These settings pertain , and if they forget their password, they will be prompted to users who use enter this answer and click the "activation link in the '''Forgot Password '''[[Email#Email Templates for User Activation and Password" link on the login page|email template]]. 

[[Image* '''Note:Password-Activation-Settings '''The best challenge questions will have answers that are simple, memorable, not easy to guess, and will not change over time.png]] 

* '''Default Security CodeExample of Challenge Questions: ''' -

* : ''In what city or town was your first job?;''<br />''What is your mother's maiden name?;''<br />''What was your first pet's name?;''Activation link life span<br />''In what year was your father born? '' - Works with the @activationlink@ [[|}====Password Variables to Set or Reset User Passwords|password variable]]. If Message====Even further down at the bottom of the '''General '''http://@url@@activationlink@page of '''Password and Activation Policies '''are features relating to a ' syntax is used in the ''Request PasswordReset Message '' section of [[User Email Templates]], this setting sets the duration that the activation link will be valid'and '''Persistent Login. '''

* :: [[File:Password reset message custom.png|800px|border]] In the text field box, write the content for the '''Challenge Questions, delimited by semi-colonsReset Password ''' - You can set message that a series of challenge questions, all users user will be prompted to select a Challenge Question on next login. Their answer will be stored and see if they will be prompted need to enter this answer if they forget reset their password and click the activation link in the "Forgot password" email . You may select between a default templateor you may choose to make it custom. 

====Persistent Login====::[[ImageFile:Challenge-questionPersistent login.png|600px|border]] The '''Persistent Login''' functionality provides for the use of a persistent secure cookie on the [[SmartSimple]] [[User|user]]'s computer to eliminate the need to use a username and password to log into the system. Rather than having to log in to SmartSimple each time you open your web browser, a "cookie" can be installed on your computer that will automatically authenticate you, allowing you to bypass the login screen. (This setting can be [[System_Security_Permissions#Miscellaneous_Feature_Permission|enabled or disabled]] by your system administrator). In order for this feature to work, you must have the user's browser enabled to accept persistent cookies.====Rules for Password Activation Settings====When an organization has their password settings configured, then they will be used in full.

:When an organization does not have their password settings configured, the system will go up the [[Organization hierarchy|organization hierarchy]] until it finds a parent company with password settings configured, and by default it will allow the organization to inherit those settings. '''NoteExample: ''' An example of a good challenge question If only the [[The Root Company|root organization]] has its password settings configured, all other organizations would be something that is simple, memorable, can't be guessed easilyinherit the same policies, and won't change over timeas they all fall under the root organization on the organization hierarchy. 

These {| class="wikitable"|-||For when a new user is sent their password for the first time||* If the password activation settings determine have a '''default security code '''but no challenge questions, the actions that should user will be prompted to enter the default security code. * If the password activation settings have a '''default security code '''and '''challenge questions, '''the user will be prompted to enter the default security code and then taken if someone attempts to log into your copy a second screen to define an answer to one of the challenge questions. The user can then go their [[SmartSimpleProfile]].* and access the '''Number of AttemptsChange Password ''' – the number of attempts page to log view and update their stored challenge question and answer.* The user will be presented with reCAPTCHA validation in with an account before the account is lockedall cases.

|-||For when an existing user requests a new password||* If the password activation settings have a '''Lockout Durationdefault security code ''' – but no challenge questions, the duration of user will be prompted to enter the account lockoutdefault security code. The [[User| * If the password activation settings have a '''default security ''''''code '''and '''challenge questions, '''the user]] will not only be able prompted to log in during this periodanswer a challenge question. Period can * The user will be set to 5 minutes, 15 minutes, 30 minutes, 1 hour, 3 hours, 12 hours, 24 hours or forever (until unlocked by [[Administrator|administrator]])presented with reCAPTCHA validation in all cases. 

* The '''View Locked Users''' tab |}After a user has successfully completed the appropriate password activation process, they will display all be logged into that SmartSimple [[User|usersinstance]] that have had and their account lockednewly created password will become active. <br> 

====Custom Policy====* If a user is lockedThe '''Compose Custom Password Policy''' table provides the ability to define the custom password policy that matches your organization's security standards and provides control of each character type desired (upper case, lower case, you numeric and/or symbols). You can click on also specify the minimum number of characters required for that character type.* The character mask used to define your selection will appear in the '''Set Custom PasswordPolicy''' field. You can also write your own code and paste it into this field if desired.* The '''Validate Pattern''' button on will open a window where you can test various passwords against the policy to see if they will pass or fail.* The value in the '''View Locked UsersCustom Password Policy Description''' tab field will be displayed to reactivate the account and send the users when setting/changing their password. You can use plain text or html in this field (For example, to insert a line break use ''&lt;br>'')* '''Note''': See also [[User|userCustom Password Policy Examples]] a new [[Password|passwordImage:Custpwpolicy.png]].

* If you need to translate the '''Custom Password Policy Description'''Once an account has been locked for exceeding the number of permitted login attempts it will remain on the "locked users" list until the correct password message you can use [[sslogic]]. It is entered. This allows the administrator often easiest to see which users have been unable to log in, even if the configured lockout duration has passed and the account is no longer technically lockeduse [[System Variables]] for these.''Example:

* <pre style="white-space: -o-pre-wrap; word-wrap: break-word;">&lt;!--@sslogic('@langid@'='When an account has been locked for exceeding the alloted number of attempts, after the lockout time has passed they are permitted only one attempt at the correct password2')-->&lt;br>@system. A single incorrect password at this point will rePassword Policy - French@&lt;!--@else--lock the account for the configured lockout duration>&lt;br>@system. In other wordsPassword Policy@&lt;!--@end--></pre>===Intruder Lockout Settings and Intruder Email Alert===The third tab in '''Password and Activation Policies, once someone is on the "locked user" list they are only permitted a single wrong attempt and they  '''called '''Intruder Alert Settings, '''will be locked for determine the lockout duration again. This prevent would-actions that should be intruders from having multiple taken if someone attempts to guess the password each time the lockout duration has passedlog into your copy of [[SmartSimple]] but cannot provide accurate credentials. ''

These settings define who should be informed by email if an intruder alert is detected.|}* '''Email From''' – the “from” address for the email. If you do not set The latter half of this value, page has the address: '''support@smartsimple.com''' will be used.* heading '''Intruder Email ToAlert - ''' – select the [[Internal|internal]] person using a default template, it allows you to receive customize the email.* '''Subject''' – the subject of the email. See below for the variables that you can use in the subject.* '''Body''' – the body alert when someone has been locked out because of the alert email. See below for the variables that you can use in the bodyintruding attempts. 

{| class="wikitable"|-||'''Intruder Alert Email VariablesFrom''' – because ||The From Address for the [[User|user]] in email alert. If you do not logged into the system manually set this value, then the amount of information available is limited to IP Address address '''donotreply@ip@smartsimple.com ''', the attempted username will be used.|-||'''@username@Email To''' and time ||Select the [[Internal]] people to receive the email alert. Click the '''@time@binoculars icon '''for a full list of internal staff, from which you can select who to send the email alert to.

==|-||'''Subject'''||The subject of the email. |-||'''Body'''||'''Sample Template - '''Clicking this will populate the text window automatically with a template of what the email alert will contain. It will include [[System Variables]]. |}'''Intruder Log==Alert Email Variables''' – because the [[User|user]] is not logged into the system, the amount of information available is limited to IP Address '''@ip@''', the attempted username '''@username@''' and date/time '''@now@''' of the attempted login.

The ===Locked Users===The '''View LogLocked Users ''' tab is used to access the '''Intruder Alert''' logwill display a [[List View Overview|list]] of all users that have had their account locked. 

:: [[ImageFile:Glob13Locked user lists.png|800px|border]]If a user is locked, you can click on the '''Set Password''' button on the '''View Locked Users''' tab to reactivate the account and send the [[User|user]] a new [[Password|password]].

* The Once an account has been locked for exceeding the number of permitted login attempts, it will remain on the '''Locked Users '''list can be sorted by clicking until the column titlecorrect password is entered.* You can filter This allows the list by [[Username|username]], yearSysAdmin to see which users have been unable to log in, even if the configured lockout duration has passed and monththe account is no longer technically locked.

The ===Disabled Inactive Users===This function is only available from '''View Locked UsersGlobal Settings > Security > Password and Activation Policies; ''' tab will display all it is not accessible from individual password policies for the different companies in your [[UserOrganization hierarchy|usersorganization hierarchy]] that have had their account locked. <br>* Once an account has been locked for exceeding the number of permitted login attempts it will remain on the "locked users" list until the correct password is entered. This allows the administrator to see which users have been unable to log in, even if the configured lockout duration has passed and the account is no longer technically locked. 

* When an account has been locked for exceeding :: [[File:Disabled inactive users.png|800px|border]] Similarly to the alloted number of attempts'''Locked Users '''tab, after the lockout time has passed they are permitted only one attempt at the correct password. A single incorrect password at this point the '''Disabled Inactive ''''''Users '''tab will re-lock the account for the configured lockout durationprovide a [[List View Overview|list]] of all expired [[User|users]] in your system. In other words, once someone is on the "locked user" list they are only permitted Their accounts have expired as a single wrong attempt result of inactivity and they will a disabling that can be locked for the lockout duration again. This prevent would-be intruders from having multiple attempts to guess the password each configured after a certain amount of time the lockout duration has passed(see [[Password Policy#Disable Inactive Accounts and Activation Settings|Disable Inactive Accounts]].

* Once an account has been disabled as a result of overly long inactivity, the user will remain on this list until their password is reset. This allows the SysAdmin to see which users have had their accounts disabled because of inactivity.* If a an inactive user is lockeddisabled, you can click on the there will be a '''Set PasswordSend Password ''' button next to reactivate their name on this tab - that way, you can reactive the account and send the [[User|user]] a new [[Password|password]]with which they can log into the system.