Changes

'''Password PolicyPolicies include the following:''' is used to configure the Password Policies within SmartSimple with your organizational policies. It is best practice to ensure that these policies match the other systems that are deployed by your organization. Consequently these policies provide for extensive configuration options.

Password Policies include the * The ability to control; the length and complexity of passwords, * The password expiration and time period * The password frequency usage, the usage * The method for sending new requested passwords, word restrictions, the (via Email Templates) * Word restrictions * The number of retries allowed, the * The lockout time for the account if they exceed the number of retries, email retry quota * Email alerts for invalid passwords.passwords 

'''Multiple password policies''' can be supported by the system. This feature provides for less stringent policies for types of users that infrequently that ''infrequently ''access the system such as external - for example, [[External]] contactswho would only use the system for an application. Alternative password policies can be set for any level in the organizational [[Organization hierarchy|organization hierarchy]].  

There You can also be set individual Password password policies for the different a company in companies of your organizations organization hierarchy. However, they will only be able to edit to ''edit ''the policy only, and not edit the [[Email#Email Templates for User Activation and Password|the Activation Emails. These emails ]], which can only be configured from [[Global Settings]] by a [[User|user]] with [[Global settingsUser Administrator|System Administrator]] [[User Role|privileges]].  

==Password Encryption==:: {{PasswordEncryptionIcon-Menu}} 2. Under the heading '''Configuration, '''select '''[[Global Settings]]. '''

[[image:password0014.png|border]]Click on the hyperlink called '''Password and Activation Policies.'''

'''Persistent Login''' provides for the use use of a persistent secure cookie on the users computer to eliminate the need to use a username A page displayed with numerous settings and password tabs related to log into the your system. '''This feature s password and activation policies will be deprecated in appear. On this page, you can modify the July 2016 upgraderequired complexities of passwords, email templates for activating users and setting passwords, disable inactive accounts, and more.''' 

:: [[File:General password activation policies.png|900px|border]] {| class="wikitable"|-||'''Tab Name'''||'''Overview of Features and Functionality'''|-||'''Disable Inactive Accounts[[Password Policy#Password Settings|General]]''' provides the ability ||Provides access to automatically modify, configure, or enable/disable a user account after a predetermined period general password settings, the deactivation of time. A inactive accounts, activation settings, password reset is required by the user to regain access to the systemmessages, and persistent login. The main options are: * |-||'''Disable user accounts after ''[X[Email#Email Templates for User Activation and Password|Activation Email Templates]]'' days''' - The number ||Allows modification and configuration of days Email Templates for the following functions: New User, Request Password, and Password Change Notification. Can also set a user account is inactive before it is disabled. Leave this field blank to disable this featuredefault language and From Address. |-* ||'''Apply [[Password Policy to All Sub-Companies#Intruder Lockout Settings and Intruder Email Alert|Intruder Alert Settings]]''' - Click button to force-update ||Allows modification of intruder settings, including the password policy amount of retries, the current company lockout duration, and all subthe content for an email alert when there is an intrusion.|-companies||'''[[Login Page#Invalid Login Audit|Invalid Login Audit]]'''||Provides a [[List View Overview|list]] of invalid logins by username, IP Address, and time for auditing and record-keeping purposes. |-||'''Note:[[Password Policy#View Locked Users|Locked Users]]'''This is applicable when an organization has ||Provides a root company list of locked users by name, Lockout Time, and the feature to directly set that user with a one or more sub-companies each with it's own new password policies. |-* ||'''[[Disable User Account After Inactive Period|Disabled Inactive Account MessageUsers]]''' - The text to be displayed to ||Provides a user trying to access an expired accountlist of disabled, inactive users by name and date of disabling. |}===Password Encryption===For your information, if necessary: 

===Password Settings===This section , under the first tab of the '''Password and Activation Policies '''labelled '''General, '''is used to set password attributes. 

:: [[imageFile:General password-002settings.png|400px|border]]{| class="wikitable"|-||'''Password Length'''||The minimum length allowed for a password; the number inputted must be between '''6 - 32 characters.'''|-||'''Complexity'''||Set the level of character-type complexity required for a password. The options are as follows: 

* '''Maximum Password Update in 24 HoursNo Restriction - ''' – Sets the maximum number of password changes a user can make within a 24 hour period any character can be definedused; this is the default. * '''Alpha Only - '''only letters are able to be used. This is to prevent users bypassing * '''Alpha & Numeric - '''both letters and numbers must be used in the password history restriction by changing their password repeatedly to return to .* '''Alpha & Numeric & Special Characters - '''a previously combination of letters, numbers, and special characters must be used password. This setting only pertains to  * '''Custom Policy - '''a password changes by use of "Update Password" by user, not to the "Forgot Password" link or system administrators using "Set Passwordpolicy can be custom-defined." 

'''Password lengthDisable Restriction of Common Passwords - ''' – the minimum length allowed for a [[Password|password]], between Toggling on this function will then '''6 and 32 charactersenable ''the user's ability to use common passwords as their password. This is not recommended for security reasons, as common passwords are easier to guess and to enable security breaches. 

|-||'''Data RestrictionsForce Password Change''' ||'''Force New Password on First Login - passwords set by users can  '''This will ensure that each individual user will be restricted so values such as first name, last name forced to change their password from a system-generated or organization name cannot be used in the SysAdmin-determined password. Any number into one of fields can be selected from both the organization or the user profile; standard and custom fields are supportedtheir own accord. 

[[image* '''Note:password-008 '''This first login does not count towards the Maximum Password Update in 24 Hours setting.png]] 

|-||'''ComplexityPassword Expiration''' – ||Each user will be forced to change their password once the level selected number of complexity required in the [[Password|password]]days has passed. Doing so every quarter or so is good security practice; however, the options are:* '''No Restriction''' – any character number of days can be usedset. This  On each login, the system will check how many days until the password expires and will notify the user their password is the defaultabout to expire in X days.* |-||'''Alpha OnlyPassword History Check''' – only letters ||You can be usedset the number of previous passports (to a maximum of 32) that the system will remember for each user.* '''Alpha & Numeric''' – letters and numbers must When changing their password, users will not be used in the permitted to re-use a previous password.* that is remembered by the '''Alpha & Numeric & Special charactersPassword History ''' – letters, numbers and special characters must be until the specified number of unique passwords have been used. * |-||'''Custom PolicyMaximum Password Changes in 24 Hours''' ||This will set the maximum number of password changes any individual user is able to make within a 24- hour period. This is to prevent users from bypassing the password history restriction by changing their password repeatedly in order to return to a previously used password policy can be custom defined.

* The |-||'''Compose Custom Password PolicyData Restriction''' table provides the ability to define the custom ||Configuring this setting will restrict password policy settings so that matches your organization's security standards and provides control of each character type desired (upper casevalues such as first name, lower caselast name, numeric and/or symbols). You can also specify the minimum number of characters required for that character type. * The character mask used to define your selection will appear in the organization name ''cannot 'Custom Password Policy''' fieldbe used in the password. You Any number of fields can also write your own code and paste it into this field if desired.* The be selected from both the '''Validate PatternOrganization ''' button will open a window where you can test various passwords against the policy to see if they will pass or fail. * The value in the the '''Custom Password Policy DescriptionContact ''' field will be displayed to users when setting/changing their password. You can use plain text or html in this field (For example, to insert a line break use ''<br>'')* '''Note''': See also [[Custom Password Policy ExamplesProfile]][[Image:Custpwpolicy.png]] 

'''Important:Organization Field ''' When defining a - Both [[Standard Fields|standard]] and [[Custom Fields|custom password policy be sure to provide a detailed description of the policy in the '''Custom Password Policy Description''' field so that users fields]] are aware of the minimum requirement to enable them to create a valid passwordsupported. 

If you need to translate the '''Custom Password Policy DescriptionContact Field ''' message you can use - Both [[sslogicStandard Fields|standard]]. It is often easiest to use and [[System VariablesCustom Fields|custom fields]] for these. Example:<pre style="white-space: pre-wrap; white-space: -moz-pre-wrap; white-space: -pre-wrap; white-space: -o-pre-wrap; word-wrap: break-word;">&lt;!--@sslogic('@langid@'='2')-->&lt;br>@systemare supported.Password Policy - French@&lt;!--@else-->&lt;br>@system.Password Policy@&lt;!--@end--></pre> 

|}====Disable Inactive Accounts and Activation Settings=Hierarchical Password Policy===When viewing a company in your hierarchy, select Scrolling down further on the '''Settings > Password PolicyGeneral ''' to define. <br/><br/>A different password policy can be defined for each company within the system. <br/><br/>If there are password policies defined for a company then it settings page will automatically apply bring you to all sub-companies in the [[Creating_an_Organization_Chart_and_Company_Hierarchy|hierarchy]], unless those sub-companies have defined their own password policy. <br/><br/>If there are no password policies defined for a company, then the system will look at the companies above it in the hierarchy, and if one of these parent companies have a password policy set then it will use these settings. <br/><br/>If there are no password policies defined for a company, or any of the companies above it in the hierarchy, then the password policy sections that allow you to set in [[Global_Settings|Global Settings]] will apply.<br/><br/>''NOTE:'' There are no settings stored in the database criteria for a company until someone actually opens the Password Policy page for that company disabling and clicks Saveactivating accounts. 

==New [[User]] accounts can be configured to automatically become disabled after a predetermined period of inactivity. Once disabled, a [[Password Settings==Policy#Password Reset Message|password reset]] is required by the user to regain access to the system. This feature adds to the many user management options within the system.

:: [[imageFile:password003Password disable and activate.png|500px|border]]{| class="wikitable"|-||'''Disable user accounts after ''X ''days'''||Insert the number of days a user account is inactive before it is disabled. In order to disable this feature, simply leave the field blank.|-||'''Apply Policy to All Sub-Companies'''||Click this button to force-update the password policy related to the current organization and all sub-companies. 

* '''Force Password ChangeNote: ''' - Appears with button marked '''Expire All Passwords Now'''. Ensures that all users will be forced to rest their password This is applicable when they next log in. * '''First Login''' - Ensures that the user selects an organization has a password of their own choosing the first time they log into [[SmartSimpleThe Root Company|root organization]], and one or more sub-companies each with its own password policies. <br />''(Does not count towards'' Maximum Password Update in 24 Hours ''setting.)''

* |-||'''Password ExpirationDisabled Inactive Account Message''' - Each user ||Write in the text that will be forced displayed when a user is attempting to access an expired account.|-||'''Enable reCAPTCHA Validation'''|||-||'''Activation link life span'''||This function works with the @activationlink@ [[Password Variables to change their Set or Reset User Passwords|password once variable]]. If the '''https://@url@@activationlink@ '''syntax is used in the '''Request Password '''section of [[Email#Email Templates for User Activation and Password|email templates]], this setting sets the duration that the activation link will be valid for the selected user in ''number of days has passed. Any number of days can be sethours. ''

* '''Password History CheckNote: ''' - You can set the number of previous passwords (Best practice is to a maximum of 32) that the system provide around 24 hours. Providing too little time will remember for each user. When changing their password, force you to continuously resend links as users will not be permitted more likely to re-use a previous password until the specified number of unique passwords have been usedforget to activate their accounts in time. 

==|-||'''Default Security Code'''||This is a hard-coded value to be entered when users request new passwords.  For example, 12345. |-||'''Challenge Questions, delimited by semi-colons'''||You can set a series of challenge questions through which all users will be prompted to select one upon next login. Their answer to that question will be stored in the system, and if they forget their password, they will be prompted to enter this answer and click the activation link in the '''Forgot Password '''[[Email#Email Templates for User Activation and Password Activation Settings==|email template]]. 

Password Activation Settings can be set * '''Note: '''The best challenge questions will have answers that are simple, memorable, not easy to add an extra layer of security to the system. These settings pertain to users who use the "Forgot Password" link on the login pageguess, and will not change over time. 

[[Image'''Example of Challenge Questions:Password-Activation-Settings.png]] '''

* : ''In what city or town was your first job?;'Default Security Code'<br />'' - A hard-coded value What is your mother's maiden name?;''<br />''What was your first pet's name?;''<br />''In what year was your father born? ''|}====Password Reset Message====Even further down at the bottom of the '''General '''page of '''Password and Activation Policies '''are features relating to be entered when users request new passwordsa '''Password Reset Message '''and '''Persistent Login.  '''

* '''Activation link life span''' - Works with the @activationlink@ :: [[File:Password Variables to Set or Reset User Passwordsreset message custom.png|800px|password variableborder]]. If  In the text field box, write the content for the '''<nowiki>http://@url@@activationlink@</nowiki>''' syntax is used in the 'Reset Password 'Request Password'' section of [[User Email Templates]], this setting sets the duration message that the activation link a user will be validsee if they need to reset their password. You may select between a default template or you may choose to make it custom. 

* ====Persistent Login====:: [[File:Persistent login.png|600px|border]] The '''Challenge Questions, delimited by semi-colonsPersistent Login''' - You can set a series functionality provides for the use of challenge questions, all users will be prompted to select a persistent secure cookie on the [[SmartSimple]] [[Challenge QuestionUser|user]] on next login's computer to eliminate the need to use a username and password to log into the system. Their answer will  Rather than having to log in to SmartSimple each time you open your web browser, a "cookie" can be stored and they installed on your computer that will be prompted automatically authenticate you, allowing you to enter bypass the login screen. (This setting can be [[System_Security_Permissions#Miscellaneous_Feature_Permission|enabled or disabled]] by your system administrator). In order for this answer if they forget feature to work, you must have the user's browser enabled to accept persistent cookies.====Rules for Password Activation Settings====When an organization has their password and click the activation link settings configured, then they will be used in the "Forgot password" email templatefull.

When an organization does not have their password settings configured, the system will go up the [[Organization hierarchy|organization hierarchy]] until it finds a parent company with password settings configured, and by default it will allow the organization to inherit those settings. '''Example: '''If only the [[Image:Challenge-question.pngThe Root Company|link=root organization]]has its password settings configured, all other organizations would inherit the same policies, as they all fall under the root organization on the organization hierarchy. 

:* '''Note: ''' An example of a good challenge question would be something organization will display informational text at the top saying that is simple, memorable, can't be guessed easily, and won't change over timeits password policies have not been configured until they are. 

{| class===Rules for Password Activation Settings==="wikitable"|-The following rules apply to the above settings ||For when users request a new passwords:user is sent their password for the first time||* If a the password activation settings have a '''default security code has been entered and code '''but no challenge questions have been entered, the user will be prompted to enter the default security code. * If a the password activation settings have a '''default security code has been entered and code '''and '''challenge questions have been entered,  '''the user will only be prompted to enter the default security code and then taken to a second screen to define an answer a to one of the challenge questions. The user can then go their [[Profile]] and access the '''Change Password '''page to view and update their stored challenge questionand answer.* The user will be presented with [[CAPTCHA]] reCAPTCHA validation in all cases.

After successful completion of Password Activation|-||For when an existing user requests a new password||* If the password activation settings have a '''default security code '''but no challenge questions, the user will be logged in and their new prompted to enter the default security code. * If the password activation settings have a '''default security ''''''code '''and '''challenge questions, '''the user will only be activeprompted to answer a challenge question.* The user will be presented with reCAPTCHA validation in all cases. 

====Custom Policy====* The '''Compose Custom Password Policy''' table provides the ability to define the custom password policy that matches your organization's security standards and provides control of each character type desired (upper case, lower case, numeric and/or symbols). You can also specify the minimum number of characters required for that character type.* The character mask used to define your selection will appear in the '''Custom Password Policy''' field. You can also write your own code and paste it into this field if desired.* The '''Validate Pattern''' button will open a window where you can test various passwords against the policy to see if they will pass or fail.* The value in the '''Custom Password Policy Description''' field will be displayed to users when setting/changing their password. You can use plain text or html in this field (For example, to insert a line break use ''&lt;br>'')* '''Note''': See also [[Custom Password Policy Examples]][image[Image:password-006Custpwpolicy.png]]

These settings determine the actions that should '''Important:''' When defining a custom password policy be taken if someone attempts sure to log into your copy provide a detailed description of [[SmartSimple]].* the policy in the '''Number of AttemptsCustom Password Policy Description''' – field so that users are aware of the number of attempts minimum requirement to enable them to log in with an account before the account is lockedcreate a valid password.

* '''Lockout Duration''' – the duration of If you need to translate the account lockout. The [[User|user]] will not be able to log in during this period. Period can be set to 5 minutes, 15 minutes, 30 minutes, 1 hour, 3 hours, 12 hours, 24 hours or forever (until unlocked by [[Administrator|administrator]]). * '''Lockout MessageCustom Password Policy Description''' - a custom message to display to users when a user is locked out due to too many failed login attempts. This message will only display when a user has been locked out, and attempts to log in again with the correct password. Therefore, no information will be divulged to users that fail their login. * The '''View Locked Users''' tab will display all [[User|users]] that have had their account locked. <br> * If a user is locked, you can click on the '''Set Password''' button on the '''View Locked Users''' tab to reactivate the account and send the [[User|user]] a new use [[Password|passwordsslogic]].  * ''Once an account has been locked for exceeding the number of permitted login attempts it will remain on the "locked users" list until the correct password It is entered. This allows the administrator often easiest to see which users have been unable to log in, even if the configured lockout duration has passed and the account is no longer technically locked.'' * ''When an account has been locked for exceeding the allotted number of attempts, after the lockout time has passed they are permitted only one attempt at the correct password. A single incorrect password at this point will re-lock the account for the configured lockout duration. In other words, once someone is on the "locked user" list they are only permitted a single wrong attempt and they will be locked for the lockout duration again. This prevents would-be intruders from having multiple attempts to guess the password each time the lockout duration has passed. '' ==Password Reset Message== use [[image:password-005.pngSystem Variables]] This feature provides the ability to overwrite the standard Password Reset message with a custom message for your organization. ==Intruder Email Alert== These settings define who should be informed by email if an intruder alert is detectedthese. A default emial template is used and contains the following valuesExample: [[File:10-12-2016 1-15-24 PM.png]] The Default template uses the primary contact on the root company record to populate the '''Email To'''.  You can save the default template and then modify ifrequired. * '''Email From''' – the “from” address for the email. If you do not set this value, the address: '''donotreply@smartsimple.com''' will be used.* '''Email To''' – select the [[Internal|internal]] people to receive the email.* '''Subject''' – the subject of the email. See below for the variables that you can use in the subject.* '''Body''' – the body of the alert email. See below for the variables that you can use in the body. '''Intruder Alert Email Variables''' – because the [[User|user]] is not logged into the system, the amount of information available is limited to IP Address '''@ip@''', the attempted username '''@username@''' and date/time '''@now@''' of the attempted login.

<pre style="white-space: -o-pre-wrap; word-wrap: break-word;">&lt;!--@sslogic('@langid@'='2')-->&lt;br>@system.Password Policy - French@&lt;!--@else-->&lt;br>@system.Password Policy@&lt;!--@end--></pre>===Intruder Lockout Settings and Intruder LogEmail Alert===The third tab in '''Password and Activation Policies, '''called '''Intruder Alert Settings, '''will determine the actions that should be taken if someone attempts to log into your copy of [[SmartSimple]] but cannot provide accurate credentials.

The :: [[File:Intruder alert settings new.png|600px|border]]{| class="wikitable"|-||'''Number of Attempts'''||Enter a number from 1-32 that will denote the amount of times someone can 'View Log'attempt '' tab to log in with an account (that is used to access the , with an incorrect password) before that account is locked. |-||'''Intruder AlertLockout Duration''' ||Select from a number of options the duration of the account lockout. Within this period, the user will have no ability to login, even if their credentials are correct. 

* Options: 5 minutes, 15 minutes, 20 minutes, 1 hour, 3 hours, 12 hours, 24 hours or Forever* '''Note: '''If the '''Forever '''option is selected for the lockout duration, the user will have no access to login ''until ''manually unlocked by the [[Image:Glob13.pngGlobal User Administrator|System Administrator]] 

* |}The list can be sorted by clicking latter half of this page has the column title.* You can filter heading '''Intruder Email Alert - '''using a default template, it allows you to customize the list by [[Username|username]], year, and monthemail alert when someone has been locked out because of intruding attempts. 

|-||'''Subject'''||The subject of the email. |-||'''Body'''||'''Sample Template - '''Clicking this will populate the text window automatically with a template of what the email alert will contain. It will include [[Image:ViewLockedUsersSystem Variables]].png |1000px}'''Intruder Alert Email Variables''' – because the [[User|user]] is not logged into the system, the amount of information available is limited to IP Address '''@ip@''', the attempted username '''@username@''' and date/time '''@now@''' of the attempted login.

The ===Locked Users===The '''View Locked UsersUsers ''' tab will display all a [[UserList View Overview|userslist]]  of all users that have had their account locked. <br>* Once an account has been locked for exceeding the number of permitted login attempts it will remain on the "locked users" list until the correct password is entered. This allows the administrator to see which users have been unable to log in, even if the configured lockout duration has passed and the account is no longer technically locked. 

* When an account has been :: [[File:Locked user lists.png|800px|border]]If a user is locked for exceeding the alloted number of attempts, after the lockout time has passed they are permitted only one attempt at the correct password. A single incorrect password at this point will re-lock you can click on the '''Set Password''' button on the '''View Locked Users''' tab to reactivate the account for the configured lockout duration. In other words, once someone is on the "locked and send the [[User|user" list they are only permitted a single wrong attempt and they will be locked for the lockout duration again. This prevent would-be intruders from having multiple attempts to guess the ]] a new [[Password|password each time the lockout duration has passed]].

* If a user is Once an account has been lockedfor exceeding the number of permitted login attempts, you can click it will remain on the the '''Set PasswordLocked Users ''' button list until the correct password is entered. This allows the SysAdmin to reactivate see which users have been unable to log in, even if the account configured lockout duration has passed and send the [[User|user]] a new [[Password|password]]account is no longer technically locked.

[[Image:ViewExpiredUsers* A single incorrect password at this point will '''re-lock '''the account for the configured lockout duration.png|1000px]] * This is a preventative measure so that would-be intruders do not have multiple attempts to guess the password each time the lockout duration has passed. 

* The ===Disabled Inactive Users===This function is only available from '''View Expired UsersGlobal Settings > Security > Password and Activation Policies; ''' tab will display all it is not accessible from individual password policies for the different companies in your [[UserOrganization hierarchy|usersorganization hierarchy]] that had their accounts disabled due to [[Password_Policy#Section_1:_Persistent_Login_and_Expiration_of_Inactive_Accounts|inactivity]]. There will be page navigation options if there is an overly long list.  

* Once an account has been expired for having been :: [[File:Disabled inactive for longer that users.png|800px|border]] Similarly to the permitted number '''Locked Users '''tab, the '''Disabled Inactive ''''''Users '''tab will provide a [[List View Overview|list]] of days it will remain on the "all expired [[User|users" list until their password is reset]] in your system. This allows the administrator to see which users Their accounts have been expiredas a result of inactivity and a disabling that can be configured after a certain amount of time (see [[Password Policy#Disable Inactive Accounts and Activation Settings|Disable Inactive Accounts]].

* Once an account has been disabled as a result of overly long inactivity, the user will remain on this list until their password is reset. This allows the SysAdmin to see which users have had their accounts disabled because of inactivity.* If a an inactive user is expireddisabled, you can click on the there will be a '''Send PasswordPassword ''' button next to reactivate their name on this tab - that way, you can reactive the account and send the [[User|user]] a new [[Password|password]]with which they can log into the system.