Changes

__TOC__==Overview=='''Password Policy '''is used to configure the password policies within [[SmartSimple]] with your organizational standards. It is best practice to ensure that these policies match the other systems deployed by your organization; consequently, these policies allow for extensive configuration options.  '''Password Policies include the following:''' * The ability to control the length and complexity of passwords* The password expiration time period * The password frequency usage * The method for sending new requested passwords (via Email Templates) * Word restrictions * The number of retries allowed* The lockout time for the account if they exceed retry quota * Email alerts for invalid passwords  Multiple password policies can be supported by the system. This feature provides for less stringent policies for types of users that ''infrequently ''access the system - for example, [[External]] contacts who would only use the system for an application. Alternative password policies can be set for any level in the [[Organization hierarchy|organization hierarchy]].  You can also set individual password policies for the different companies of your organization hierarchy. However, they will be able to ''edit ''the policy only, and not edit the [[Email#Email Templates for User Activation and Password|the Activation Emails]], which can only be configured from [[Global Settings]] by a [[User|user]] with [[Global User Administrator|System Administrator]] [[User Role|privileges]].  : '''Note: '''In all cases of password policies, '''common words '''or '''known common passwords '''are ineligible to be used as [[SmartSimple]] passwords. ==Configuration - Essentials=====How to Access the Password Settings===1. Click on the 9-square menu icon on the top right of your page.

==Overview==4. Click on the hyperlink called '''Password Policyand Activation Policies.''' is used  A page displayed with numerous settings and tabs related to control your system's password and activation policies will appear. On this page, you can modify the length and complexity required complexities of passwords, password expiration email templates for activating users and historysetting passwords, the number of retries that the [[User|user]] is alloweddisable inactive accounts, and the lockout time for the account if they exceed the number of retriesmore. 

:: [[File:General password activation policies.png|900px|border]] {| class==The "wikitable"|-||'''Tab Name'''||'''Overview of Features and Functionality'''|-||'''[[Password Policy#Password Settings|General]]'''||Provides access to modify, configure, or enable/disable general password settings, the deactivation of inactive accounts, activation settings, password reset messages, and persistent login.|-||'''[[Email#Email Templates for User Activation and Password|Activation Email Templates]]'''||Allows modification and configuration of Email Templates for the following functions: New User, Request Password, and Password Change Notification. Can also set a default language and From Address. |-||'''[[Password Policy #Intruder Lockout Settings and Intruder Email Alert|Intruder Alert Settings]]'''||Allows modification of intruder settings, including the amount of retries, the lockout duration, and the content for an email alert when there is an intrusion.|-||'''[[Login Page Illustrated==#Invalid Login Audit|Invalid Login Audit]]'''||Provides a [[List View Overview|list]] of invalid logins by username, IP Address, and time for auditing and record-keeping purposes.|-||'''[[Image:PasswordPolicynewPassword Policy#View Locked Users|Locked Users]]'''||Provides a list of locked users by name, Lockout Time, and the feature to directly set that user with a new password.png |-||'''[[Disable User Account After Inactive Period|link=Disabled Inactive Users]]'''||Provides a list of disabled, inactive users by name and date of disabling. |}===Password Encryption===For your information, if necessary: 

==Expiration of Inactive Accounts=Password Settings===This section control , under the expiration first tab of inactive accounts. User accounts can become automatically disabled after a predetermined period of time. A password reset the '''Password and Activation Policies '''labelled '''General, '''is required by the user used to regain access to the system. This feature empowers organizations and adds to the many account management options availableset password attributes. 

:: [[File:General password settings.png|400px|border]]{| class="wikitable"|-||'''Password Length'''[[Disable User Account After Inactive Period||Details on configuring this section is located hereThe minimum length allowed for a password; the number inputted must be between '''6 - 32 characters.]]'''|-||'''Complexity'''||Set the level of character-type complexity required for a password. The options are as follows: 

'''Maximum Password Update in 24 HoursDisable Restriction of Common Passwords - '''Toggling on this function will then '' – The maximum number of password changes a enable ''the user can make within a 24 hour period can be defined. This is 's ability to prevent users bypassing the password history restriction by changing use common passwords as their password repeatedly to return to a previously used password. This setting only pertains is not recommended for security reasons, as common passwords are easier to password changes by use of "Update Password" by user, not guess and to the "Forgot Password" link or system administrators using "Set Passwordenable security breaches." 

|-||'''Force Password lengthChange'''||''' – the minimum length allowed for Force New Password on First Login - '''This will ensure that each individual user will be forced to change their password from a [[Password|system-generated or SysAdmin-determined password]], between 6 and 32 charactersinto one of their own accord. 

* '''Complexity''' – the level of complexity required in the [[Password|password]], the options areNote:* '''No Restriction ''' – any character can be used. This is first login does not count towards the default.* '''Alpha Only''' – only letters can be used.* '''Alpha & Numeric''' – letters and numbers must be used Maximum Password Update in the password.* '''Alpha & Numeric & Special characters''' – letters, numbers and special characters must be used.* '''Custom Policy''' - a password policy can be custom defined24 Hours setting. 

If '''Expire All Passwords Now - '''This is a handy button that will immediately invalidate all passwords in the system, ensuring that each user attempts will have to change the Algorithm then as soon as reset their passwords when they click Save they will next log in. A good use-case of this function might be presented with an alert if you updated your password policy to inform them that existing require more complex passwords for ; by expiring all users passwords, every user in your system will no longer be valid if have to create new passwords that fall under the new password algorithm is changed, and providing them with the opportunity to abandon the change.[[Image:AlgorithmAlertcriteria.png|border]] 

Editor|-||'''Password Expiration'''||Each user will be forced to change their password once the selected number of days has passed. Doing so every quarter or so is good security practice; however, any number of days can be set. On each login, the system will check how many days until the password expires and will notify the user their password is about to expire in X days.|-||'''Password History Check'''||You can set the number of previous passports (to a maximum of 32) that the system will remember for each user. When changing their password, users will not be permitted to re-use a previous password that is remembered by the 's note: Feature removed with March 2014 upgrade''Password History '''until the specified number of unique passwords have been used. See ticket 23966  |- new ||'''Maximum Password Changes in 24 Hours'''||This will set the maximum number of password algorithm for SHAchanges any individual user is able to make within a 24-256 with salt hash and stretching hour period. This is to prevent users from bypassing the password history restriction by changing their password repeatedly in order to return to a previously used password.

-->===Custom Policy===* The '''Compose Custom Password Policy''' table allows you This setting only pertains to define the custom password policy changes by enabling each character set desired (upper case, lower case, numeric and/or symbols) and specifying the minimum number of characters required for that character set. * The system code used to enforce your selection will appear in the use of '''Custom Password PolicyUpdate Password ''' field. You can also write your own code and paste by the user - it into this field if desired.* The is not relevant to the '''Validate PatternForgot Password ''' button will open a window where you can test various passwords against the policy link nor to see if they will pass or fail. * The value in the [[Global User Administrator|System Administrators]] ability to '''Custom Password Policy DescriptionSet Password ''' field will be displayed to for users when setting/changing their password. You can use plain text or html in this field (For example, to insert a line break use ''<br>'')* '''Note''': See also [[Custom Password Policy Examples]][[Image:Custpwpolicy.png]] 

|-||'''Important:Password Data Restriction''' When defining a custom ||Configuring this setting will restrict password policy settings so that values such as first name, last name, or organization name ''cannot ''be sure to provide a detailed description of the policy used in the password. Any number of fields can be selected from both the '''Custom Password Policy DescriptionOrganization '''or the '''Contact ''' field so that users are aware of the minimum requirement to enable them to create a valid password[[Profile]]. 

If you need to translate the '''Custom Password Policy DescriptionOrganization Field ''' message you can use - Both [[sslogicStandard Fields|standard]]. It is often easiest to use and [[System VariablesCustom Fields|custom fields]] for these. Example:<pre style="white-space: pre-wrap; white-space: -moz-pre-wrap; white-space: -pre-wrap; white-space: -o-pre-wrap; word-wrap: break-word;">&lt;!--@sslogic('@langid@'='2')-->&lt;br>@systemare supported.Password Policy - French@&lt;!--@else-->&lt;br>@system.Password Policy@&lt;!--@end--></pre> 

===Hierarchical Password Policy===When viewing a company in your hierarchy, select '''Settings > Password Policy''' to define. <br/><br/>A different password policy [[User]] accounts can be defined for each company within the systemconfigured to automatically become disabled after a predetermined period of inactivity. <br/><br/>If there are password policies defined for a company then it will automatically apply to all sub-companies in the Once disabled, a [[Creating_an_Organization_Chart_and_Company_HierarchyPassword Policy#Password Reset Message|hierarchypassword reset]], unless those sub-companies have defined their own password policy. <br/><br/>If there are no password policies defined for a company, then  is required by the user to regain access to the system will look at the companies above it in the hierarchy, and if one of these parent companies have a password policy set then it will use these settings. <br/><br/>If there are no password policies defined for a company, or any of This feature adds to the companies above it in many user management options within the hierarchy, then the password policy set in [[Global_Settings|Global Settings]] will applysystem.

==New :: [[File:Password Settings=disable and activate.png|500px|border]]{| class="wikitable" |-* ||'''Force New Password on First LoginDisable user accounts after ''X ''days''' - Ensures that ||Insert the number of days a user selects a password of their own choosing account is inactive before it is disabled. In order to disable this feature, simply leave the first time they log into [[SmartSimple]]field blank. <br />|-||''(Does not count towards'Apply Policy to All Sub-Companies' Maximum Password Update in 24 Hours ''setting||Click this button to force-update the password policy related to the current organization and all sub-companies.)'' 

* '''Password ExpirationNote: ''' This is applicable when an organization has a [[The Root Company|root organization]], and one or more sub- Each user will be forced to change their companies each with its own password once the selected number of days has passed. Any number of days can be setpolicies.

* |-||'''Password History CheckDisabled Inactive Account Message''' - You can set ||Write in the number of previous passwords (to a maximum of 32) text that the system will remember for each be displayed when a useris attempting to access an expired account. When changing their |-||'''Enable reCAPTCHA Validation'''|||-||'''Activation link life span'''||This function works with the @activationlink@ [[Password Variables to Set or Reset User Passwords|passwordvariable]]. If the '''https://@url@@activationlink@ '''syntax is used in the '''Request Password '''section of [[Email#Email Templates for User Activation and Password|email templates]], users this setting sets the duration that the activation link will not be permitted to re-use a previous password until valid for the specified user in ''number of unique passwords have been usedhours. ''

Password Activation Settings |-||'''Default Security Code'''||This is a hard-coded value to be entered when users request new passwords.  For example, 12345. |-||'''Challenge Questions, delimited by semi-colons'''||You can set a series of challenge questions through which all users will be set prompted to add an extra layer of security select one upon next login. Their answer to that question will be stored in the system. These settings pertain , and if they forget their password, they will be prompted to users who use enter this answer and click the "activation link in the '''Forgot Password '''[[Email#Email Templates for User Activation and Password" link on the login page|email template]]. 

[[Image* '''Note:Password-Activation-Settings '''The best challenge questions will have answers that are simple, memorable, not easy to guess, and will not change over time.png]] 

* '''Default Security CodeExample of Challenge Questions: ''' - A hard-coded value to be entered when users request new passwords.

* : ''In what city or town was your first job?;'Activation link life span'<br />'' - Works with the @activationlink@ [[Password Variables to Set or Reset User Passwords|password variable]]. If the What is your mother's maiden name?;''<nowikibr />http://@url@@activationlink@''What was your first pet's name?;''<br /nowiki>''In what year was your father born? '' syntax is used in |}====Password Reset Message====Even further down at the bottom of the '''General '''page of '''Password and Activation Policies '''are features relating to a '''Request PasswordReset Message '''and ''' section of [[User Email Templates]], this setting sets the duration that the activation link will be validPersistent Login. '''

* :: [[File:Password reset message custom.png|800px|border]] In the text field box, write the content for the '''Challenge Questions, delimited by semi-colonsReset Password ''' - You can set message that a series of challenge questions, all users user will be prompted to select a [[Challenge Question]] on next login. Their answer will be stored and see if they will be prompted need to enter this answer if they forget reset their password and click the activation link in the "Forgot password" email . You may select between a default templateor you may choose to make it custom. 

====Persistent Login====::[[ImageFile:Challenge-questionPersistent login.png|link=600px|border]] The '''Persistent Login''' functionality provides for the use of a persistent secure cookie on the [[SmartSimple]] [[User|user]]'s computer to eliminate the need to use a username and password to log into the system. Rather than having to log in to SmartSimple each time you open your web browser, a "cookie" can be installed on your computer that will automatically authenticate you, allowing you to bypass the login screen. (This setting can be [[System_Security_Permissions#Miscellaneous_Feature_Permission|enabled or disabled]] by your system administrator). In order for this feature to work, you must have the user's browser enabled to accept persistent cookies.====Rules for Password Activation Settings====When an organization has their password settings configured, then they will be used in full.

:When an organization does not have their password settings configured, the system will go up the [[Organization hierarchy|organization hierarchy]] until it finds a parent company with password settings configured, and by default it will allow the organization to inherit those settings. '''NoteExample: ''' An example of a good challenge question If only the [[The Root Company|root organization]] has its password settings configured, all other organizations would be something that is simple, memorable, can't be guessed easilyinherit the same policies, and won't change over timeas they all fall under the root organization on the organization hierarchy. 

===Rules for Password Activation Settings===The following rules apply to the above settings when users request new passwords* '''Note:* If a default security code has been entered and no challenge questions have been entered, the user  '''An organization will be prompted to enter the default security code.* If a default security code has been entered and challenge questions have been entered, display informational text at the user will only be prompted to answer a challenge question.* If neither a default security code nor challenge questions top saying that its password policies have not been entered, the user will be presented with [[CAPTCHA]] validationconfigured until they are. 

After successful completion of Password Activation{| class="wikitable"|-||For when a new user is sent their password for the first time||* If the password activation settings have a '''default security code '''but no challenge questions, the user will be prompted to enter the default security code. * If the password activation settings have a '''default security code '''and '''challenge questions,  '''the user will be logged in prompted to enter the default security code and then taken to a second screen to define an answer to one of the challenge questions. The user can then go their [[Profile]] and access the '''Change Password '''page to view and update their new password stored challenge question and answer.* The user will be activepresented with reCAPTCHA validation in all cases.

These settings determine |}After a user has successfully completed the actions that should appropriate password activation process, they will be taken if someone attempts to log logged into your copy of that SmartSimple [[SmartSimpleinstance]]and their newly created password will become active.* '''Number of Attempts''' – the number of attempts to log in with an account before the account is locked. 

====Custom Policy====* The '''Lockout DurationCompose Custom Password Policy''' – table provides the ability to define the duration custom password policy that matches your organization's security standards and provides control of each character type desired (upper case, lower case, numeric and/or symbols). You can also specify the account lockoutminimum number of characters required for that character type. * The [[User|user]] character mask used to define your selection will not be able to log appear in during the '''Custom Password Policy''' field. You can also write your own code and paste it into this periodfield if desired. Period * The '''Validate Pattern''' button will open a window where you can test various passwords against the policy to see if they will pass or fail.* The value in the '''Custom Password Policy Description''' field will be set displayed to 5 minutes, 15 minutes, 30 minutes, 1 hour, 3 hours, 12 hours, 24 hours users when setting/changing their password. You can use plain text or forever html in this field (until unlocked by For example, to insert a line break use ''&lt;br>'')* '''Note''': See also [[Administrator|administratorCustom Password Policy Examples]])[[Image:Custpwpolicy.png]]

* '''Lockout MessageImportant:''' - When defining a custom message password policy be sure to display provide a detailed description of the policy in the '''Custom Password Policy Description''' field so that users are aware of the minimum requirement to users when a user is locked out due enable them to too many failed login attempts. This message will only display when create a user has been locked out, and attempts to log in again with the correct valid password. Therefore, no information will be divulged to users that fail their login.

* The '''View Locked Users''' tab will display all [[User|users]] that have had their account locked. <br> * If a user is locked, you can click on need to translate the '''Set Custom PasswordPolicy Description''' button on the '''View Locked Users''' tab to reactivate the account and send the message you can use [[User|usersslogic]] a new . It is often easiest to use [[Password|passwordSystem Variables]]for these.Example:

* :: [[File:Intruder alert settings new.png|600px|border]]{| class="wikitable"|-||'''Number of Attempts'''||Enter a number from 1-32 that will denote the amount of times someone can ''attempt ''Once to log in with an account has been (that is, with an incorrect password) before that account is locked for exceeding the . |-||'''Lockout Duration'''||Select from a number of permitted login attempts it will remain on options the "locked users" list until duration of the correct password is enteredaccount lockout. This allows Within this period, the administrator to see which users user will have been unable no ability to log in, even if the configured lockout duration has passed and the account is no longer technically lockedtheir credentials are correct.'' 

* Options: 5 minutes, 15 minutes, 20 minutes, 1 hour, 3 hours, 12 hours, 24 hours or Forever* ''When an account has been locked 'Note: '''If the '''Forever '''option is selected for exceeding the allotted number of attempts, after the lockout time has passed they are permitted only one attempt at the correct password. A single incorrect password at this point will re-lock the account for the configured lockout duration. In other words, once someone is on the "locked user" list they are only permitted a single wrong attempt and they will be locked for the lockout duration again. This prevents would-be intruders from having multiple attempts have no access to guess the password each time the lockout duration has passed. login ''until ''manually unlocked by the [[Global User Administrator|System Administrator]] 

==|}The latter half of this page has the heading '''Intruder Email Alert==- '''using a default template, it allows you to customize the email alert when someone has been locked out because of intruding attempts. 

These settings define who should be informed by email if an intruder alert is detected.{| class="wikitable"|-* ||'''Email From''' – the “from” address ||The From Address for the emailalert. If you do not manually set this value, then the address: address '''supportdonotreply@smartsimple.comcom ''' will be used.* |-||'''Email To''' – select ||Select the [[Internal|internal]] people to receive the emailalert.* Click the '''Subjectbinoculars icon ''' – the subject for a full list of the email. See below for the variables that internal staff, from which you can use in the subject.* '''Body''' – the body of select who to send the email alert email. See below for the variables that you can use in the bodyto.

* '''Intruder Alert Email VariablesNote: ''' – because The Default Template will use the [[UserOrganization hierarchy#Organization Ownership|userprimary contact]] is not logged into of the system, the amount of information available is limited [[The Root Company|root organization]] to IP Address populate the '''@ip@'Email To '', the attempted username '''@username@''' and date/time '''@now@''' of the attempted loginfield. 

==|-||'''Subject'''||The subject of the email. |-||'''Body'''||'''Sample Template - '''Clicking this will populate the text window automatically with a template of what the email alert will contain. It will include [[System Variables]]. |}'''Intruder Log==Alert Email Variables''' – because the [[User|user]] is not logged into the system, the amount of information available is limited to IP Address '''@ip@''', the attempted username '''@username@''' and date/time '''@now@''' of the attempted login.

The ===Locked Users===The '''View LogLocked Users ''' tab is used to access the '''Intruder Alert''' logwill display a [[List View Overview|list]] of all users that have had their account locked. 

:: [[ImageFile:Glob13Locked user lists.png|800px|border]]If a user is locked, you can click on the '''Set Password''' button on the '''View Locked Users''' tab to reactivate the account and send the [[User|user]] a new [[Password|password]].

* The Once an account has been locked for exceeding the number of permitted login attempts, it will remain on the '''Locked Users '''list can be sorted by clicking until the column titlecorrect password is entered.* You can filter This allows the list by [[Username|username]], yearSysAdmin to see which users have been unable to log in, even if the configured lockout duration has passed and monththe account is no longer technically locked.

The ===Disabled Inactive Users===This function is only available from '''View Locked UsersGlobal Settings > Security > Password and Activation Policies; ''' tab will display all it is not accessible from individual password policies for the different companies in your [[UserOrganization hierarchy|usersorganization hierarchy]] that have had their account locked. <br>* Once an account has been locked for exceeding the number of permitted login attempts it will remain on the "locked users" list until the correct password is entered. This allows the administrator to see which users have been unable to log in, even if the configured lockout duration has passed and the account is no longer technically locked. 

* When an account has been locked for exceeding :: [[File:Disabled inactive users.png|800px|border]] Similarly to the alloted number of attempts'''Locked Users '''tab, after the lockout time has passed they are permitted only one attempt at the correct password. A single incorrect password at this point the '''Disabled Inactive ''''''Users '''tab will re-lock the account for the configured lockout durationprovide a [[List View Overview|list]] of all expired [[User|users]] in your system. In other words, once someone is on the "locked user" list they are only permitted Their accounts have expired as a single wrong attempt result of inactivity and they will a disabling that can be locked for the lockout duration again. This prevent would-be intruders from having multiple attempts to guess the password each configured after a certain amount of time the lockout duration has passed(see [[Password Policy#Disable Inactive Accounts and Activation Settings|Disable Inactive Accounts]].

* Once an account has been disabled as a result of overly long inactivity, the user will remain on this list until their password is reset. This allows the SysAdmin to see which users have had their accounts disabled because of inactivity.* If a an inactive user is lockeddisabled, you can click on the there will be a '''Set PasswordSend Password ''' button next to reactivate their name on this tab - that way, you can reactive the account and send the [[User|user]] a new [[Password|password]]with which they can log into the system.