Changes

'''Password PolicyPolicy ''' is used to configure the Password Policies password policies within [[SmartSimple ]] with your organizational policiesstandards. It is best practice to ensure that these policies match the other systems that are deployed by your organization. Consequently ; consequently, these policies provide allow for extensive configuration options. 

'''Password Policies include the ability to control; the length and complexity of passwords, password expiration and frequency usage, the method for sending new requested passwords, word restrictions, the number of retries allowed, the lockout time for the account if they exceed the number of retries, email alerts for invalid passwords.following:'''

'''Multiple * The ability to control the length and complexity of passwords* The password expiration time period * The password policies''' can be supported by the system. This feature provides frequency usage * The method for less stringent policies sending new requested passwords (via Email Templates) * Word restrictions * The number of retries allowed* The lockout time for types of users that infrequently access the system such as external contacts. Alternative password policies can be set account if they exceed retry quota * Email alerts for any level in the organizational hierarchy.invalid passwords 

There Multiple password policies can also be individual Password supported by the system. This feature provides for less stringent policies for types of users that ''infrequently ''access the different a company in your organizations hierarchy. Howeversystem - for example, they will [[External]] contacts who would only be able to edit use the policy and not the Activation Emailssystem for an application. These emails Alternative password policies can only be configured from set for any level in the [[Global SettingsOrganization hierarchy|Global settingsorganization hierarchy]]. 

==Settings=====Password Encryption===:: {{PasswordEncryptionIcon-Menu}} 2. Under the heading '''Configuration, '''select '''[[Global Settings]]. '''

===Persistent Login A page displayed with numerous settings and Expiration tabs related to your system's password and activation policies will appear. On this page, you can modify the required complexities of Inactive Accounts===[[image:password001passwords, email templates for activating users and setting passwords, disable inactive accounts, and more.png|border]] 

:: [[File:General password activation policies.png|900px|border]] {| class="wikitable"|-||'''Tab Name''Persistent Login'||'''Overview of Features and Functionality'''|-||'''[[Password Policy#Password Settings|General]]''' provides for ||Provides access to modify, configure, or enable/disable general password settings, the use use deactivation of a inactive accounts, activation settings, password reset messages, and persistent secure cookie on login.|-||'''[[Email#Email Templates for User Activation and Password|Activation Email Templates]]'''||Allows modification and configuration of Email Templates for the users computer to eliminate the need to use following functions: New User, Request Password, and Password Change Notification. Can also set a username default language and password to log into the systemFrom Address.  |-||'''[[Password Policy#Intruder Lockout Settings and Intruder Email Alert|Intruder Alert Settings]]'''This feature will be deprecated in ||Allows modification of intruder settings, including the amount of retries, the lockout duration, and the July 2016 upgradecontent for an email alert when there is an intrusion.|-||'''[[Login Page#Invalid Login Audit|Invalid Login Audit]]'''||Provides a [[List View Overview|list]] of invalid logins by username, IP Address, and time for auditing and record-keeping purposes.|-||'''Disable Inactive Accounts[[Password Policy#View Locked Users|Locked Users]]''' provides ||Provides a list of locked users by name, Lockout Time, and the ability feature to automatically disable directly set that user with a user account after new password. |-||'''[[Disable User Account After Inactive Period|Disabled Inactive Users]]'''||Provides a predetermined period list of time. A password reset is required disabled, inactive users by the user to regain access to the systemname and date of disabling. The main options are |}===Password Encryption===For your information, if necessary: 

===Password Settings Section===This section , under the first tab of the '''Password and Activation Policies '''labelled '''General, '''is used to set password attributes. 

:: [[imageFile:General password-002settings.png|400px|border]]{| class="wikitable"|-||'''Password Length'''||The minimum length allowed for a password; the number inputted must be between '''6 - 32 characters.'''|-||'''Complexity'''||Set the level of character-type complexity required for a password. The options are as follows: 

* '''Maximum Password Update in 24 HoursNo Restriction - ''' – Sets the maximum number of password changes a user can make within a 24 hour period any character can be definedused; this is the default. * '''Alpha Only - '''only letters are able to be used. This is to prevent users bypassing * '''Alpha & Numeric - '''both letters and numbers must be used in the password history restriction by changing their password repeatedly to return to .* '''Alpha & Numeric & Special Characters - '''a previously combination of letters, numbers, and special characters must be used password. This setting only pertains to  * '''Custom Policy - '''a password changes by use of "Update Password" by user, not to the "Forgot Password" link or system administrators using "Set Passwordpolicy can be custom-defined." 

'''Password lengthDisable Restriction of Common Passwords - ''' – the minimum length allowed for a [[Password|password]], between Toggling on this function will then '''6 and 32 charactersenable ''the user's ability to use common passwords as their password. This is not recommended for security reasons, as common passwords are easier to guess and to enable security breaches. 

|-||'''Data RestrictionsForce Password Change''' ||'''Force New Password on First Login - passwords set by users can  '''This will ensure that each individual user will be restricted so values such as first name, last name forced to change their password from a system-generated or organization name cannot be used in the SysAdmin-determined password. Any number into one of fields can be selected from both the organization or the user profile; standard and custom fields are supportedtheir own accord. 

[[image* '''Note:password-008 '''This first login does not count towards the Maximum Password Update in 24 Hours setting.png]] 

====Password Complexity====* This setting only pertains to password changes by use of '''ComplexityUpdate Password ''' – by the level of complexity required in user - it is not relevant to the '''Forgot Password '''link nor to the [[PasswordGlobal User Administrator|passwordSystem Administrators]], the options are:ability to '''Set Password '''for users. 

* |-||'''No Password Data Restriction''' – any character can be used. This is the default.* '''Alpha Only''' – only letters can be used.||* Configuring this setting will restrict password settings so that values such as first name, last name, or organization name ''cannot 'Alpha & Numeric''' – letters and numbers must be used in the password.* Any number of fields can be selected from both the '''Alpha & Numeric & Special charactersOrganization ''' – letters, numbers and special characters must be used.* or the '''Custom PolicyContact ''' - a password policy can be custom defined[[Profile]]. 

====Custom Policy====* The '''Compose Custom Password Policy'Organization Field '' table provides the ability to define the custom password policy that matches your organization's security standards and provides control of each character type desired (upper case, lower case, numeric and/or symbols). You can also specify the minimum number of characters required for that character type.* The character mask used to define your selection will appear in the '''Custom Password Policy''' field. You can also write your own code and paste it into this field if desired.* The '''Validate Pattern''' button will open a window where you can test various passwords against the policy to see if they will pass or fail.* The value in the '''Custom Password Policy Description''' field will be displayed to users when setting/changing their password. You can use plain text or html in this field (For example, to insert a line break use ''<br>'')* '''Note''': See also - Both [[Custom Password Policy ExamplesStandard Fields|standard]]and [[Image:Custpwpolicy.pngCustom Fields|custom fields]]are supported. 

'''Important:Contact Field ''' When defining a - Both [[Standard Fields|standard]] and [[Custom Fields|custom password policy be sure to provide a detailed description of the policy in the '''Custom Password Policy Description''' field so that users fields]] are aware of the minimum requirement to enable them to create a valid passwordsupported. 

If you need to translate the |}====Disable Inactive Accounts and Activation Settings====Scrolling down further on the '''Custom Password Policy DescriptionGeneral ''' message password settings page will bring you to the sections that allow you can use [[sslogic]]. It is often easiest to use [[System Variables]] set the criteria for thesedisabling and activating accounts. Example: 

<pre style="white-space: -o-pre-wrap; word-wrap: break-word;">&lt;!--@sslogic('@langid@'='2')-->&lt;br>@system[[User]] accounts can be configured to automatically become disabled after a predetermined period of inactivity.Once disabled, a [[Password Policy - French@&lt;!--@else-->&lt;br>@#Password Reset Message|password reset]] is required by the user to regain access to the system. This feature adds to the many user management options within the system.Password Policy@&lt;!--@end--></pre>

===New Password Settings==='''Note: '''This is applicable when an organization has a [[image:password003.pngThe Root Company|borderroot organization]], and one or more sub-companies each with its own password policies.

* |-||'''Disabled Inactive Account Message'''Force Password Change||Write in the text that will be displayed when a user is attempting to access an expired account.|-||'''Enable reCAPTCHA Validation''' |||- Appears ||'''Activation link life span'''||This function works with button marked the @activationlink@ [[Password Variables to Set or Reset User Passwords|password variable]]. If the '''https://@url@@activationlink@ '''syntax is used in the '''Expire All Passwords NowRequest Password '''. Ensures section of [[Email#Email Templates for User Activation and Password|email templates]], this setting sets the duration that all users the activation link will be forced to rest their password when they next log invalid for the user in ''number of hours. ''

* '''First LoginNote: ''' - Ensures that the user selects a password of Best practice is to provide around 24 hours. Providing too little time will force you to continuously resend links as users will be more likely to forget to activate their own choosing the first accounts in time they log into [[SmartSimple]]. <br />''(Does not count towards'' Maximum Password Update in 24 Hours ''setting.)'' 

* |-||'''Password ExpirationDefault Security Code'''||This is a hard-coded value to be entered when users request new passwords.  For example, 12345. |-||''' Challenge Questions, delimited by semi- Each user colons'''||You can set a series of challenge questions through which all users will be forced prompted to select one upon next login. Their answer to change that question will be stored in the system, and if they forget their password once , they will be prompted to enter this answer and click the selected number of days has passed. Any number of days can be setactivation link in the '''Forgot Password '''[[Email#Email Templates for User Activation and Password|email template]]. 

* '''Password History CheckNote: ''' - You can set the number of previous passwords (The best challenge questions will have answers that are simple, memorable, not easy to a maximum of 32) that the system will remember for each user. When changing their passwordguess, users and will not be permitted to re-use a previous password until the specified number of unique passwords have been usedchange over time. 

===:: [[File:Password Activation Settings===reset message custom.png|800px|border]] Password Activation Settings can be set In the text field box, write the content for the '''Reset Password '''message that a user will see if they need to add an extra layer of security to the systemreset their password. These settings pertain You may select between a default template or you may choose to users who use the "Forgot Password" link on the login pagemake it custom. 

====Persistent Login====:: [[ImageFile:Persistent login.png|600px|border]] The '''Persistent Login''' functionality provides for the use of a persistent secure cookie on the [[SmartSimple]] [[User|user]]'s computer to eliminate the need to use a username and password to log into the system. Rather than having to log in to SmartSimple each time you open your web browser, a "cookie" can be installed on your computer that will automatically authenticate you, allowing you to bypass the login screen. (This setting can be [[System_Security_Permissions#Miscellaneous_Feature_Permission|enabled or disabled]] by your system administrator). In order for this feature to work, you must have the user's browser enabled to accept persistent cookies.====Rules for Password-Activation-Settings====When an organization has their password settings configured, then they will be used in full.png]]

* When an organization does not have their password settings configured, the system will go up the [[Organization hierarchy|organization hierarchy]] until it finds a parent company with password settings configured, and by default it will allow the organization to inherit those settings. '''Default Security CodeExample: ''' - A hard-coded value to be entered when users request new passwordsIf only the [[The Root Company|root organization]] has its password settings configured, all other organizations would inherit the same policies, as they all fall under the root organization on the organization hierarchy. 

* '''Activation link life span''' - Works with the @activationlink@ [[Password Variables to Set or Reset User Passwords|password variable]]. If the '''<nowiki>httpsNote://@url@@activationlink@</nowiki> ''' syntax is used in An organization will display informational text at the ''Request Password'' section of [[User Email Templates]], this setting sets the duration top saying that the activation link will be validits password policies have not been configured until they are. 

{| class="wikitable"|-||For when a new user is sent their password for the first time||* If the password activation settings have a '''Challenge Questionsdefault security code '''but no challenge questions, delimited by semi-colonsthe user will be prompted to enter the default security code. * If the password activation settings have a '''default security code '''and ''' - You can set a series of challenge questions, all users  '''the user will be prompted to select enter the default security code and then taken to a second screen to define an answer to one of the challenge questions. The user can then go their [[Challenge QuestionProfile]] on next login. Their answer will be and access the '''Change Password '''page to view and update their stored challenge question and they answer.* The user will be prompted to enter this answer if they forget their password and click the activation link presented with reCAPTCHA validation in the "Forgot password" email templateall cases.

: [[Image:Challenge|-question.png||For when an existing user requests a new password||link=]]: * If the password activation settings have a '''Note:default security code ''' An example of a good but no challenge question would questions, the user will be something that is simpleprompted to enter the default security code. * If the password activation settings have a '''default security ''''''code '''and '''challenge questions, memorable, can '''t the user will only be prompted to answer a challenge question.* The user will be guessed easily, and won't change over timepresented with reCAPTCHA validation in all cases. 

===Rules for Password Activation Settings===|}The following rules apply to After a user has successfully completed the above settings when users request new passwords:appropriate password activation process, they will be logged into that SmartSimple [[instance]] and their newly created password will become active. 

====Custom Policy====* If a default The '''Compose Custom Password Policy''' table provides the ability to define the custom password policy that matches your organization's security code has been entered standards and no challenge questions have been enteredprovides control of each character type desired (upper case, lower case, numeric and/or symbols). You can also specify the user minimum number of characters required for that character type.* The character mask used to define your selection will be prompted to enter appear in the default security '''Custom Password Policy''' field. You can also write your own codeand paste it into this field if desired.* If The '''Validate Pattern''' button will open a default security code has been entered and challenge questions have been entered, window where you can test various passwords against the user policy to see if they will only be prompted to answer a challenge questionpass or fail.* The user value in the '''Custom Password Policy Description''' field will be presented with displayed to users when setting/changing their password. You can use plain text or html in this field (For example, to insert a line break use ''&lt;br>'')* '''Note''': See also [[CAPTCHACustom Password Policy Examples]] validation in all cases[[Image:Custpwpolicy.png]]

After successful completion '''Important:''' When defining a custom password policy be sure to provide a detailed description of the policy in the '''Custom Password Activation, Policy Description''' field so that users are aware of the user will be logged in and their new minimum requirement to enable them to create a valid password will be active.

===Intruder Lockout Settings===:: [[imageFile:password-006Intruder alert settings new.png|600px|border]]{| class="wikitable"These settings determine the actions that should be taken if someone attempts to log into your copy of [[SmartSimple]].|- * ||'''Number of Attempts''' – ||Enter a number from 1-32 that will denote the number amount of attempts to log in with an account before the account is locked. * times someone can '''Lockout Duration'attempt '' – the duration of the account lockout. The [[User|user]] will not be able to log in during this period. Period can be set to 5 minutes, 15 minutes, 30 minutes, 1 hour, 3 hours, 12 hours, 24 hours or forever with an account (until unlocked by [[Administrator|administrator]]). * '''Lockout Message''' - a custom message to display to users when a user that is locked out due to too many failed login attempts. This message will only display when a user has been locked out, and attempts to log in again with the correct an incorrect password. Therefore, no information will be divulged to users that fail their login. * The '''View Locked Users''' tab will display all [[User|users]] ) before that have had their account is locked.  |-* If a user is locked, you can click on the ||'''Set PasswordLockout Duration''' button on the '''View Locked Users''' tab to reactivate the account and send the [[User|user]] a new [[Password|password]].   * ''Once an account has been locked for exceeding the Select from a number of permitted login attempts it will remain on the "locked users" list until the correct password is entered. This allows the administrator to see which users have been unable to log in, even if options the configured lockout duration has passed and of the account is no longer technically locked.'' * ''When an account has been locked for exceeding the allotted number of attempts, after the lockout time has passed they are permitted only one attempt at the correct password. A single incorrect password at Within this point will re-lock the account for the configured lockout duration. In other wordsperiod, once someone is on the "locked user" list they are only permitted a single wrong attempt and they will be locked for the lockout duration again. This prevents would-be intruders from having multiple attempts to guess the password each time the lockout duration has passed. '' ===Password Reset Message===[[image:password-005.png]] This feature provides the have no ability to overwrite the standard Password Reset message with a custom message for your organization.   ===Intruder Email Alert===These settings define who should be informed by email if an intruder alert is detected. A default emial template is used and contains the following values: [[File:10-12-2016 1-15-24 PM.png]] The Default template uses the primary contact on the root company record to populate the '''Email To'''.  You can save the default template and then modify ifrequired. * '''Email From''' – the “from” address for the email. If you do not set this value, the address: '''donotreply@smartsimple.com''' will be used.* '''Email To''' – select the [[Internal|internal]] people to receive the email.* '''Subject''' – the subject of the email. See below for the variables that you can use in the subject.* '''Body''' – the body of the alert email. See below for the variables that you can use in the body. '''Intruder Alert Email Variables''' – because the [[User|user]] is not logged into the system, the amount of information available is limited to IP Address '''@ip@''', the attempted username '''@username@''' and date/time '''@now@''' of the attempted login.   ===Intruder Log===The '''View Log''' tab is used to access the '''Intruder Alert''' log. [[Image:Glob13.png]] * The list can be sorted by clicking the column title.* You can filter the list by [[Username|username]], year, and month.  ===Hierarchical Password Policy===When viewing a company in your hierarchy, select '''Settings > Password Policy''' to define. <br/><br/> A different password policy can be defined for each company within the system. <br/><br/> If there are password policies defined for a company then it will automatically apply to all sub-companies in the [[Creating_an_Organization_Chart_and_Company_Hierarchy|hierarchy]], unless those sub-companies have defined even if their own password policy. <br/><br/> If there credentials are no password policies defined for a company, then the system will look at the companies above it in the hierarchy, and if one of these parent companies have a password policy set then it will use these settingscorrect. <br/><br/> If there are no password policies defined for a company, or any of the companies above it in the hierarchy, then the password policy set in [[Global_Settings|Global Settings]] will apply.<br/><br/> ''NOTE:'' There are no settings stored in the database for a company until someone actually opens the Password Policy page for that company and clicks Save.  

==View Locked Users==* Options: 5 minutes, 15 minutes, 20 minutes, 1 hour, 3 hours, 12 hours, 24 hours or ForeverThis * '''Note: '''If the '''Forever '''option is only available from selected for the Password Policy on lockout duration, the user will have no access to login ''until ''manually unlocked by the [[Category:Global SettingsUser Administrator|Global settingsSystem Administrator]]. It cannot be accessed for the individual Password policies for the different companies in your organizations hierarchy. 

[[Image:ViewLockedUsers|}The latter half of this page has the heading '''Intruder Email Alert - '''using a default template, it allows you to customize the email alert when someone has been locked out because of intruding attempts.png|1000px]] 

{| class="wikitable"|-||'''Email From'''||The From Address for the email alert. If you do not manually set this value, then the address '''View Locked Usersdonotreply@smartsimple.com ''' tab will display all be used.|-||'''Email To'''||Select the [[User|usersInternal]] that have had their account lockedpeople to receive the email alert. Click the '''binoculars icon '''for a full list of internal staff, from which you can select who to send the email alert to.

* Once an account has been locked for exceeding '''Note: '''The Default Template will use the number [[Organization hierarchy#Organization Ownership|primary contact]] of permitted login attempts it will remain on the "locked users" list until the correct password is entered. This allows the administrator to see which users have been unable [[The Root Company|root organization]] to log in, even if the configured lockout duration has passed and the account is no longer technically lockedpopulate the '''Email To '''field. 

* When an account has been locked for exceeding the alloted number |-||'''Subject'''||The subject of attempts, after the lockout time has passed they are permitted only one attempt at the correct passwordemail. A single incorrect password at  |-||'''Body'''||'''Sample Template - '''Clicking this point will re-lock populate the account for text window automatically with a template of what the configured lockout durationemail alert will contain. It will include [[System Variables]]. In other words |}'''Intruder Alert Email Variables''' – because the [[User|user]] is not logged into the system, once someone the amount of information available is on the "locked user" list they are only permitted a single wrong attempt and they will be locked for the lockout duration again. This prevent would-be intruders from having multiple attempts limited to guess IP Address '''@ip@''', the password each time attempted username '''@username@''' and date/time '''@now@''' of the lockout duration has passedattempted login.

* If a user is locked, you can click on the ===Locked Users===The '''Set PasswordLocked Users ''' button to reactivate the account and send the tab will display a [[UserList View Overview|user]] a new [[Password|passwordlist]] of all users that have had their account locked. 

==View Expired Users==This option is only available from When an account has been locked for exceeding the Password Policy on number of permitted login attempts, after the [[Category:Global Settings|Global settings]]. It can not be accessed for the individual Password policies for lockout time has passed they are permitted only ''ONE ''attempt at the different companies in your organizations hierarchycorrect password. 

[[Image:ViewExpiredUsers* A single incorrect password at this point will '''re-lock '''the account for the configured lockout duration.png|1000px]] * This is a preventative measure so that would-be intruders do not have multiple attempts to guess the password each time the lockout duration has passed. 

* The ===Disabled Inactive Users===This function is only available from '''View Expired UsersGlobal Settings > Security > Password and Activation Policies; ''' tab will display all it is not accessible from individual password policies for the different companies in your [[UserOrganization hierarchy|usersorganization hierarchy]] that had their accounts disabled due to [[Password_Policy#Section_1:_Persistent_Login_and_Expiration_of_Inactive_Accounts|inactivity]]. There will be page navigation options if there is an overly long list. 

* Once an account has been expired for having been :: [[File:Disabled inactive for longer that users.png|800px|border]] Similarly to the permitted number '''Locked Users '''tab, the '''Disabled Inactive ''''''Users '''tab will provide a [[List View Overview|list]] of days it will remain on the "all expired [[User|users" list until their password is reset]] in your system. This allows the administrator to see which users Their accounts have been expiredas a result of inactivity and a disabling that can be configured after a certain amount of time (see [[Password Policy#Disable Inactive Accounts and Activation Settings|Disable Inactive Accounts]].

* Once an account has been disabled as a result of overly long inactivity, the user will remain on this list until their password is reset. This allows the SysAdmin to see which users have had their accounts disabled because of inactivity.* If a an inactive user is expireddisabled, you can click on the there will be a '''Send PasswordPassword ''' button next to reactivate their name on this tab - that way, you can reactive the account and send the [[User|user]] a new [[Password|password]]with which they can log into the system.