Changes

==Overview==Multiple password policies can be supported by the system. This feature provides for less stringent policies for types of users that ''infrequently 'Password Policy''' is used to configure access the system - for example, [[External]] contacts who would only use the Password Policies within SmartSimple with your organizational policiessystem for an application. It is best practice to ensure that these Alternative password policies match can be set for any level in the other systems that are deployed by your [[Organization hierarchy|organizationhierarchy]]. Consequently these policies provide for extensive configuration options. 

Password Policies include the ability to control; You can also set individual password policies for the length and complexity different companies of passwords, password expiration and frequency usage, the method for sending new requested passwords, word restrictionsyour organization hierarchy. However, they will be able to ''edit ''the number of retries allowedpolicy only, and not edit the lockout time [[Email#Email Templates for User Activation and Password|the account if they exceed the number of retriesActivation Emails]], email alerts for invalid passwordswhich can only be configured from [[Global Settings]] by a [[User|user]] with [[Global User Administrator|System Administrator]] [[User Role|privileges]]. 

: '''Multiple Note: '''In all cases of password policies, '''common words '''or ''' can known common passwords '''are ineligible to be supported by used as [[SmartSimple]] passwords. ==Configuration - Essentials=====How to Access the systemPassword Settings===1. This feature provides for less stringent policies for types of users that infrequently access Click on the system such as external contacts. Alternative password policies can be set for any level in 9-square menu icon on the organizational hierarchytop right of your page.

==Password Encryption==:: {{PasswordEncryptionIcon-Menu}} 2. Under the heading '''Configuration, '''select '''[[Global Settings]]. '''

[[image:password-0014.png]]Click on the hyperlink called '''Password and Activation Policies.'''

'''Persistent Login''' provides for the use use of a persistent secure cookie on the users computer to eliminate the need to use a username A page displayed with numerous settings and password tabs related to log into the your system. '''This feature s password and activation policies will be deprecated in appear. On this page, you can modify the July 2016 upgraderequired complexities of passwords, email templates for activating users and setting passwords, disable inactive accounts, and more.''' 

:: [[File:General password activation policies.png|900px|border]] {| class="wikitable"|-||'''Tab Name'''Expiration ||'''Overview of Inactive AccountsFeatures and Functionality'''|-||'''[[Password Policy#Password Settings|General]]''' provides the ability ||Provides access to automatically modify, configure, or enable/disable general password settings, the deactivation of inactive accounts, activation settings, password reset messages, and persistent login.|-||'''[[Email#Email Templates for User Activation and Password|Activation Email Templates]]'''||Allows modification and configuration of Email Templates for the following functions: New User, Request Password, and Password Change Notification. Can also set a user account after default language and From Address. |-||'''[[Password Policy#Intruder Lockout Settings and Intruder Email Alert|Intruder Alert Settings]]'''||Allows modification of intruder settings, including the amount of retries, the lockout duration, and the content for an email alert when there is an intrusion.|-||'''[[Login Page#Invalid Login Audit|Invalid Login Audit]]'''||Provides a predetermined period [[List View Overview|list]] of invalid logins by username, IP Address, and timefor auditing and record-keeping purposes. A password reset is required |-||'''[[Password Policy#View Locked Users|Locked Users]]'''||Provides a list of locked users by name, Lockout Time, and the feature to directly set that user to regain access to the systemwith a new password.  |-||'''[[Disable User Account After Inactive Period|Details on configuring this section is located here.Disabled Inactive Users]]'''||Provides a list of disabled, inactive users by name and date of disabling. |}===Password Encryption===For your information, if necessary: 

===Password Settings===This section , under the first tab of the '''Password and Activation Policies '''labelled '''General, '''is used to set password attributes. 

:: [[imageFile:General password-002settings.png|400px|border]]{| class="wikitable"|-||'''Password Length'''||The minimum length allowed for a password; the number inputted must be between '''6 - 32 characters.'''|-||'''Complexity'''||Set the level of character-type complexity required for a password. The options are as follows: 

* '''Maximum Password Update in 24 HoursNo Restriction - ''' – Sets the maximum number of password changes a user can make within a 24 hour period any character can be definedused; this is the default. * '''Alpha Only - '''only letters are able to be used. This is to prevent users bypassing * '''Alpha & Numeric - '''both letters and numbers must be used in the password history restriction by changing their password repeatedly to return to .* '''Alpha & Numeric & Special Characters - '''a previously combination of letters, numbers, and special characters must be used password. This setting only pertains to  * '''Custom Policy - '''a password changes by use of "Update Password" by user, not to the "Forgot Password" link or system administrators using "Set Passwordpolicy can be custom-defined." 

'''Password lengthDisable Restriction of Common Passwords - ''' – the minimum length allowed for a [[Password|password]], between Toggling on this function will then '''6 and 32 charactersenable ''the user's ability to use common passwords as their password. This is not recommended for security reasons, as common passwords are easier to guess and to enable security breaches. 

|-||'''Data RestrictionsForce Password Change''' ||'''Force New Password on First Login - passwords set by users can  '''This will ensure that each individual user will be restricted so values such as first name, last name forced to change their password from a system-generated or organization name cannot be used in the SysAdmin-determined password. Any number into one of fields can be selected from both the organization or the user profile; standard and custom fields are supportedtheir own accord. 

[[image* '''Note:password-008 '''This first login does not count towards the Maximum Password Update in 24 Hours setting.png]] 

|-||'''ComplexityPassword Expiration''' – ||Each user will be forced to change their password once the level selected number of complexity required in the [[Password|password]]days has passed. Doing so every quarter or so is good security practice; however, the options are:* '''No Restriction''' – any character number of days can be usedset. This is  On each login, the system will check how many days until the default.* '''Alpha Only''' – only letters can be used.* '''Alpha & Numeric''' – letters password expires and numbers must be used in will notify the user their passwordis about to expire in X days.* '''Alpha & Numeric & Special characters''' – letters, numbers and special characters must be used.* '''Custom Policy''' |- a password policy can be custom defined. ===Custom Policy=== * The ||'''Compose Custom Password PolicyHistory Check''' table provides ||You can set the ability number of previous passports (to define the custom password policy that matches your organization's security standards and provides control a maximum of each character type desired (upper case, lower case, numeric and/or symbols32). You can also specify that the minimum number of characters required system will remember for that character typeeach user. * The character mask used When changing their password, users will not be permitted to define your selection will appear in the re-use a previous password that is remembered by the '''Custom Password PolicyHistory ''' field. You can also write your own code and paste it into this field if desireduntil the specified number of unique passwords have been used. |-* The ||'''Validate PatternMaximum Password Changes in 24 Hours''' button ||This will open a window where you can test various passwords against set the policy maximum number of password changes any individual user is able to see if they will pass or failmake within a 24-hour period. * The value in the '''Custom Password Policy Description''' field will be displayed This is to prevent users when setting/from bypassing the password history restriction by changing their password. You can use plain text or html repeatedly in this field (For example, order to return to insert a line break use ''<br>'')* '''Note''': See also [[Custom Password Policy Examples]][[Image:Custpwpolicypreviously used password.png]]

* This setting only pertains to password changes by use of '''Update Password '''by the user - it is not relevant to the '''Important:Forgot Password ''' When defining a custom password policy be sure link nor to provide a detailed description of the policy in the [[Global User Administrator|System Administrators]] ability to '''Custom Password Policy DescriptionSet Password ''' field so that for users are aware of the minimum requirement to enable them to create a valid password. 

If you need to translate the |-||'''Custom Password Policy DescriptionData Restriction''' message you can use [[sslogic]]. It is often easiest to use [[System Variables]] for these. Example:<pre style="white-space: pre-wrap; || white-space: -moz-pre-wrap; white-space: -pre-wrap; white-space: -o-pre-wrap; word-wrap: break-word;">&lt;!--@sslogic(Configuring this setting will restrict password settings so that values such as first name, last name, or organization name '@langid@'=cannot '2')-->&lt;br>@systembe used in the password.Password Policy - French@&lt;!--@else-->&lt;br>@systemAny number of fields can be selected from both the '''Organization '''or the '''Contact '''[[Profile]].Password Policy@&lt;!--@end--></pre> 

===Hierarchical Password Policy===When viewing a company in your hierarchy, select '''Settings > Password PolicyOrganization Field ''' to define. <br/><br/>A different password policy can be defined for each company within the system. <br/><br/>If there are password policies defined for a company then it will automatically apply to all sub-companies in the Both [[Creating_an_Organization_Chart_and_Company_HierarchyStandard Fields|hierarchystandard]], unless those sub-companies have defined their own password policy. <br/><br/>If there are no password policies defined for a company, then the system will look at the companies above it in the hierarchy, and if one of these parent companies have a password policy set then it will use these settings. <br/><br/>If there are no password policies defined for a company, or any of the companies above it in the hierarchy, then the password policy set in [[Global_SettingsCustom Fields|Global Settingscustom fields]] will applyare supported. 

[[image:password-003.png]]|} ====Disable Inactive Accounts and Activation Settings====* Scrolling down further on the '''Force New Password on First LoginGeneral ''' - Ensures password settings page will bring you to the sections that allow you to set the user selects a password of their own choosing the first time they log into [[SmartSimple]]criteria for disabling and activating accounts. <br />''(Does not count towards'' Maximum Password Update in 24 Hours ''setting.)'' 

* '''[[User]] accounts can be configured to automatically become disabled after a predetermined period of inactivity. Once disabled, a [[Password Policy#Password Expiration''' - Each Reset Message|password reset]] is required by the user will be forced to change their password once regain access to the selected number of days has passedsystem. Any number of days can be setThis feature adds to the many user management options within the system.

* :: [[File:Password disable and activate.png|500px|border]]{| class="wikitable"|-||'''Disable user accounts after ''X ''Password History Checkdays''' - You can set ||Insert the number of previous passwords (to days a maximum of 32) that the system will remember for each useraccount is inactive before it is disabled. When changing their passwordIn order to disable this feature, users will not be permitted simply leave the field blank.|-||'''Apply Policy to All Sub-Companies'''||Click this button to reforce-use a previous update the password until policy related to the specified number of unique passwords have been usedcurrent organization and all sub-companies. 

Password Activation Settings can |-||'''Disabled Inactive Account Message'''||Write in the text that will be set displayed when a user is attempting to add access an extra layer expired account.|-||'''Enable reCAPTCHA Validation'''|||-||'''Activation link life span'''||This function works with the @activationlink@ [[Password Variables to Set or Reset User Passwords|password variable]]. If the '''https://@url@@activationlink@ '''syntax is used in the '''Request Password '''section of security to [[Email#Email Templates for User Activation and Password|email templates]], this setting sets the system. These settings pertain to users who use duration that the "Forgot Password" activation link on will be valid for the login pageuser in ''number of hours. ''

[[Image* '''Note:Password-Activation-Settings '''Best practice is to provide around 24 hours.png]]Providing too little time will force you to continuously resend links as users will be more likely to forget to activate their accounts in time. 

* |-||'''Default Security Code''' - A ||This is a hard-coded value to be entered when users request new passwords.   For example, 12345. |-||'''Challenge Questions, delimited by semi-colons'''||You can set a series of challenge questions through which all users will be prompted to select one upon next login. Their answer to that question will be stored in the system, and if they forget their password, they will be prompted to enter this answer and click the activation link in the '''Forgot Password '''[[Email#Email Templates for User Activation and Password|email template]]. 

* '''Activation link life spanNote: ''' - Works with the @activationlink@ [[Password Variables The best challenge questions will have answers that are simple, memorable, not easy to Set or Reset User Passwords|password variable]]. If the '''<nowiki>http://@url@@activationlink@</nowiki>''' syntax is used in the ''Request Password'' section of [[User Email Templates]]guess, this setting sets the duration that the activation link and will be validnot change over time. 

* '''Example of Challenge Questions, delimited by semi-colons: ''' - You can set a series of challenge questions, all users will be prompted to select a [[Challenge Question]] on next login. Their answer will be stored and they will be prompted to enter this answer if they forget their password and click the activation link in the "Forgot password" email template.

:[[Image:Challenge-question.png''In what city or town was your first job?;''<br />''What is your mother's maiden name?;''<br />''What was your first pet's name?;''<br />''In what year was your father born? ''|link}=]]===Password Reset Message====Even further down at the bottom of the '''General '''page of '''Password and Activation Policies '''are features relating to a '''Password Reset Message '''and '''Persistent Login. '''

:: [[File:Password reset message custom.png|800px|border]] In the text field box, write the content for the '''Note:Reset Password ''' An example of message that a user will see if they need to reset their password. You may select between a good challenge question would be something that is simple, memorable, can't be guessed easily, and won't change over timedefault template or you may choose to make it custom. 

===Rules for Password Activation Settings=Persistent Login====:: [[File:Persistent login.png|600px|border]] The following rules apply '''Persistent Login''' functionality provides for the use of a persistent secure cookie on the [[SmartSimple]] [[User|user]]'s computer to eliminate the above settings when users request new passwords:* If need to use a default security code has been entered username and no challenge questions have been enteredpassword to log into the system. Rather than having to log in to SmartSimple each time you open your web browser, the user a "cookie" can be installed on your computer that will be prompted automatically authenticate you, allowing you to enter bypass the default security codelogin screen.* If a default security code has been entered and challenge questions (This setting can be [[System_Security_Permissions#Miscellaneous_Feature_Permission|enabled or disabled]] by your system administrator). In order for this feature to work, you must have been entered, the user will only be prompted 's browser enabled to answer a challenge questionaccept persistent cookies.* If neither a default security code nor challenge questions have been entered====Rules for Password Activation Settings====When an organization has their password settings configured, the user then they will be presented with [[CAPTCHA]] validationused in full.

After successful completion of Password ActivationWhen an organization does not have their password settings configured, the user system will be logged in go up the [[Organization hierarchy|organization hierarchy]] until it finds a parent company with password settings configured, and their new by default it will allow the organization to inherit those settings. '''Example: '''If only the [[The Root Company|root organization]] has its password will be activesettings configured, all other organizations would inherit the same policies, as they all fall under the root organization on the organization hierarchy. 

{| class="wikitable"|-||For when a new user is sent their password for the first time||* If the password activation settings have a '''default security code '''but no challenge questions, the user will be prompted to enter the default security code. * If the password activation settings have a '''default security code '''and '''challenge questions, '''the user will be prompted to enter the default security code and then taken to a second screen to define an answer to one of the challenge questions. The user can then go their [[image:password-006.pngProfile]]and access the '''Change Password '''page to view and update their stored challenge question and answer.* The user will be presented with reCAPTCHA validation in all cases.

These |-||For when an existing user requests a new password||* If the password activation settings determine have a '''default security code '''but no challenge questions, the actions that should user will be taken if someone attempts prompted to log into your copy of [[SmartSimple]]enter the default security code. * If the password activation settings have a '''default security ''''''code '''and '''Number of Attemptschallenge questions, ''' – the number of attempts user will only be prompted to log answer a challenge question.* The user will be presented with reCAPTCHA validation in with an account before the account is lockedall cases. 

* '''Lockout Duration''' – the duration of the account lockout. The [[User|}After a user]] has successfully completed the appropriate password activation process, they will not be able to log in during this period. Period can be set to 5 minutes, 15 minutes, 30 minutes, 1 hour, 3 hours, 12 hours, 24 hours or forever (until unlocked by logged into that SmartSimple [[Administrator|administratorinstance]])and their newly created password will become active. 

====Custom Policy====* The '''Lockout MessageCompose Custom Password Policy''' - a table provides the ability to define the custom message password policy that matches your organization's security standards and provides control of each character type desired (upper case, lower case, numeric and/or symbols). You can also specify the minimum number of characters required for that character type.* The character mask used to display to users when a user is locked out due to too many failed login attemptsdefine your selection will appear in the '''Custom Password Policy''' field. You can also write your own code and paste it into this field if desired. This message * The '''Validate Pattern''' button will only display when open a user has been locked out, and attempts window where you can test various passwords against the policy to log see if they will pass or fail.* The value in again with the correct password. Therefore, no information '''Custom Password Policy Description''' field will be divulged displayed to users that fail when setting/changing their loginpassword. You can use plain text or html in this field (For example, to insert a line break use ''&lt;br>'')* '''Note''': See also [[Custom Password Policy Examples]][[Image:Custpwpolicy.png]]

* The '''View Locked UsersImportant:''' tab will display all [[User|When defining a custom password policy be sure to provide a detailed description of the policy in the '''Custom Password Policy Description''' field so that users]] that have had their account lockedare aware of the minimum requirement to enable them to create a valid password. <br>

* If a user is locked, you can click on need to translate the '''Set Custom PasswordPolicy Description''' button on the '''View Locked Users''' tab to reactivate the account and send the message you can use [[User|usersslogic]] a new . It is often easiest to use [[Password|passwordSystem Variables]]for these.Example:

* :: [[File:Intruder alert settings new.png|600px|border]]{| class="wikitable"|-||'''Number of Attempts'''||Enter a number from 1-32 that will denote the amount of times someone can ''attempt ''Once to log in with an account has been (that is, with an incorrect password) before that account is locked for exceeding the . |-||'''Lockout Duration'''||Select from a number of permitted login attempts it will remain on options the "locked users" list until duration of the correct password is enteredaccount lockout. This allows Within this period, the administrator to see which users user will have been unable no ability to log in, even if the configured lockout duration has passed and the account is no longer technically lockedtheir credentials are correct.'' 

* Options: 5 minutes, 15 minutes, 20 minutes, 1 hour, 3 hours, 12 hours, 24 hours or Forever* ''When an account has been locked 'Note: '''If the '''Forever '''option is selected for exceeding the allotted number of attempts, after the lockout time has passed they are permitted only one attempt at the correct password. A single incorrect password at this point will re-lock the account for the configured lockout duration. In other words, once someone is on the "locked user" list they are only permitted a single wrong attempt and they will be locked for the lockout duration again. This prevents would-be intruders from having multiple attempts have no access to guess the password each time the lockout duration has passed. login ''until ''manually unlocked by the [[Global User Administrator|System Administrator]] 

==|}The latter half of this page has the heading '''Intruder Email Alert==- '''using a default template, it allows you to customize the email alert when someone has been locked out because of intruding attempts. 

These settings define who should be informed by email if an intruder alert is detected.{| class="wikitable"|-* ||'''Email From''' – the “from” address ||The From Address for the emailalert. If you do not manually set this value, then the address: address '''supportdonotreply@smartsimple.comcom ''' will be used.* |-||'''Email To''' – select ||Select the [[Internal|internal]] people to receive the emailalert.* Click the '''Subjectbinoculars icon ''' – the subject for a full list of the email. See below for the variables that internal staff, from which you can use in the subject.* '''Body''' – the body of select who to send the email alert email. See below for the variables that you can use in the bodyto.

* '''Intruder Alert Email VariablesNote: ''' – because The Default Template will use the [[UserOrganization hierarchy#Organization Ownership|userprimary contact]] is not logged into of the system, the amount of information available is limited [[The Root Company|root organization]] to IP Address populate the '''@ip@'Email To '', the attempted username '''@username@''' and date/time '''@now@''' of the attempted loginfield. 

==|-||'''Subject'''||The subject of the email. |-||'''Body'''||'''Sample Template - '''Clicking this will populate the text window automatically with a template of what the email alert will contain. It will include [[System Variables]]. |}'''Intruder Log==Alert Email Variables''' – because the [[User|user]] is not logged into the system, the amount of information available is limited to IP Address '''@ip@''', the attempted username '''@username@''' and date/time '''@now@''' of the attempted login.

The ===Locked Users===The '''View LogLocked Users ''' tab is used to access the '''Intruder Alert''' logwill display a [[List View Overview|list]] of all users that have had their account locked. 

:: [[ImageFile:Glob13Locked user lists.png|800px|border]]If a user is locked, you can click on the '''Set Password''' button on the '''View Locked Users''' tab to reactivate the account and send the [[User|user]] a new [[Password|password]].

* The Once an account has been locked for exceeding the number of permitted login attempts, it will remain on the '''Locked Users '''list can be sorted by clicking until the column titlecorrect password is entered.* You can filter This allows the list by [[Username|username]], yearSysAdmin to see which users have been unable to log in, even if the configured lockout duration has passed and monththe account is no longer technically locked.

The ===Disabled Inactive Users===This function is only available from '''View Locked UsersGlobal Settings > Security > Password and Activation Policies; ''' tab will display all it is not accessible from individual password policies for the different companies in your [[UserOrganization hierarchy|usersorganization hierarchy]] that have had their account locked. <br>* Once an account has been locked for exceeding the number of permitted login attempts it will remain on the "locked users" list until the correct password is entered. This allows the administrator to see which users have been unable to log in, even if the configured lockout duration has passed and the account is no longer technically locked. 

* When an account has been locked for exceeding :: [[File:Disabled inactive users.png|800px|border]] Similarly to the alloted number of attempts'''Locked Users '''tab, after the lockout time has passed they are permitted only one attempt at the correct password. A single incorrect password at this point the '''Disabled Inactive ''''''Users '''tab will re-lock the account for the configured lockout durationprovide a [[List View Overview|list]] of all expired [[User|users]] in your system. In other words, once someone is on the "locked user" list they are only permitted Their accounts have expired as a single wrong attempt result of inactivity and they will a disabling that can be locked for the lockout duration again. This prevent would-be intruders from having multiple attempts to guess the password each configured after a certain amount of time the lockout duration has passed(see [[Password Policy#Disable Inactive Accounts and Activation Settings|Disable Inactive Accounts]].

* Once an account has been disabled as a result of overly long inactivity, the user will remain on this list until their password is reset. This allows the SysAdmin to see which users have had their accounts disabled because of inactivity.* If a an inactive user is lockeddisabled, you can click on the there will be a '''Set PasswordSend Password ''' button next to reactivate their name on this tab - that way, you can reactive the account and send the [[User|user]] a new [[Password|password]]with which they can log into the system.