Smartstaff, administrator
60
edits
Changes
no edit summary
==Overview==
'''Password PolicyPolicy ''' is used to configure the Password Policies password policies within [[SmartSimple ]] with your organizational policiesstandards. It is best practice to ensure that these policies match the other systems that are deployed by your organization. Consequently ; consequently, these policies provide allow for extensive configuration options.
'''Password Policies include the ability to control; the length and complexity of passwords, password expiration and frequency usage, the method for sending new requested passwords, word restrictions, the number of retries allowed, the lockout time for the account if they exceed the number of retries, email alerts for invalid passwords.following:'''
You can also set individual password policies for the different companies of your organization hierarchy. However, they will be able to '''Common Words or known common passwords'edit '' cannot be used as passwordsthe policy only, and not edit the [[Email#Email Templates for User Activation and Password|the Activation Emails]], which can only be configured from [[Global Settings]] by a [[User|user]] with [[Global User Administrator|System Administrator]] [[User Role|privileges]].
: '''Note: '''In all cases of password policies, '''common words '''or '''known common passwords '''are ineligible to be used as [[SmartSimple]] passwords.
==Configuration - Essentials==
===How to Access the Password Settings Settings===
1. Click on the 9-square menu icon on the top right of your page.
:: {{Icon-Menu}}
2. Under the heading '''Configuration, '''select '''[[Global Settings]]. '''
A page displayed with numerous settings and tabs related to your system's password and activation policies will appear. On this page, you can modify the required complexities of passwords, email templates for activating users and setting passwords, disable inactive accounts, and more.
:: [[File:General password activation policies.png|900px|border]]
{| class="wikitable"
|-
||'''Tab Name'''
||'''Overview of Features and Functionality'''
|-
||'''[[Password Policy#Password Settings|General]]'''
||Provides access to modify, configure, or enable/disable general password settings, the deactivation of inactive accounts, activation settings, password reset messages, and persistent login.
|-
||'''[[Email#Email Templates for User Activation and Password|Activation Email Templates]]'''
||Allows modification and configuration of Email Templates for the following functions: New User, Request Password, and Password Change Notification. Can also set a default language and From Address.
|-
||'''[[Password Policy#Intruder Lockout Settings and Intruder Email Alert|Intruder Alert Settings]]'''
||Allows modification of intruder settings, including the amount of retries, the lockout duration, and the content for an email alert when there is an intrusion.
|-
||'''[[Login Page#Invalid Login Audit|Invalid Login Audit]]'''
||Provides a [[List View Overview|list]] of invalid logins by username, IP Address, and time for auditing and record-keeping purposes.
|-
||'''[[Password Policy#View Locked Users|Locked Users]]'''
||Provides a list of locked users by name, Lockout Time, and the feature to directly set that user with a new password.
|-
||'''[[Disable User Account After Inactive Period|Disabled Inactive Users]]'''
||Provides a list of disabled, inactive users by name and date of disabling.
|}
===Password Encryption===
For your information, if necessary:
{{PasswordEncryption}}
===Password Settings===
This section, under the first tab of the '''Password and Activation Policies '''labelled '''General, '''is used to set password attributes.
:: [[File:General password settings.png|400px|border]]
{| class="wikitable"
|-
||'''Password Length'''
||The minimum length allowed for a password; the number inputted must be between '''6 - 32 characters.'''
|-
||'''Complexity'''
||
Set the level of character-type complexity required for a password. The options are as follows:
'''Persistent LoginDisable Restriction of Common Passwords - ''' provides for the use use of a persistent secure cookie Toggling on the users computer to eliminate the need to use a username and password to log into the system. '''This feature this function will be deprecated in the July 2016 upgrade.then '''enable ''the user'Disable Inactive Accounts''' provides the s ability to automatically disable a user account after a predetermined period of timeuse common passwords as their password. A password reset This is required by the user not recommended for security reasons, as common passwords are easier to regain access guess and to the systemenable security breaches. The main options are:
'''Maximum Password Update in 24 HoursExpire All Passwords Now - ''' – Sets This is a handy button that will immediately invalidate all passwords in the maximum number of password changes a system, ensuring that each user can make within a 24 hour period can be defined. This is will have to prevent users bypassing the password history restriction by changing reset their password repeatedly to return to a previously used passwordpasswords when they next log in. This setting only pertains to password changes by A good use -case of "Update Password" this function might be if you updated your password policy to require more complex passwords; by expiring all passwords, every user, not in your system will have to create new passwords that fall under the "Forgot Password" link or system administrators using "Set Passwordnew password criteria."
|-||'''Password lengthExpiration''' – ||Each user will be forced to change their password once the minimum length allowed selected number of days has passed. Doing so every quarter or so is good security practice; however, any number of days can be set. On each login, the system will check how many days until the password expires and will notify the user their password is about to expire in X days.|-||'''Password History Check'''||You can set the number of previous passports (to a maximum of 32) that the system will remember for each user. When changing their password, users will not be permitted to re-use a [[previous password that is remembered by the '''PasswordHistory '''until the specified number of unique passwords have been used. |-||password]], between '''6 and 32 charactersMaximum Password Changes in 24 Hours'''||This will set the maximum number of password changes any individual user is able to make within a 24-hour period. This is to prevent users from bypassing the password history restriction by changing their password repeatedly in order to return to a previously used password.
* This setting only pertains to password changes by use of '''Data RestrictionsUpdate Password ''' - passwords set by users can be restricted so values such as first name, last name or organization name cannot be used in the password. Any number of fields can be selected from both user - it is not relevant to the '''Forgot Password '''link nor to the organization or the user profile; standard and custom fields are supported[[Global User Administrator|System Administrators]] ability to '''Set Password '''for users.
|-||'''Password Data Restriction'''||Configuring this setting will restrict password settings so that values such as first name, last name, or organization name ''cannot ''be used in the password. Any number of fields can be selected from both the '''Organization '''or the '''Contact '''[[image:password-008.pngProfile]].
'''Contact Field '''- Both [[Standard Fields|standard]] and [[Custom Fields|custom fields]] are supported.
|}
====Disable Inactive Accounts and Activation Settings====
Scrolling down further on the '''General '''password settings page will bring you to the sections that allow you to set the criteria for disabling and activating accounts.
|-||'''Important:Disabled Inactive Account Message''' When defining ||Write in the text that will be displayed when a custom password policy be sure user is attempting to provide a detailed description of access an expired account.|-||'''Enable reCAPTCHA Validation'''|||-||'''Activation link life span'''||This function works with the policy @activationlink@ [[Password Variables to Set or Reset User Passwords|password variable]]. If the '''https://@url@@activationlink@ '''syntax is used in the the '''Custom Password Policy DescriptionRequest Password ''' field so section of [[Email#Email Templates for User Activation and Password|email templates]], this setting sets the duration that users are aware of the minimum requirement to enable them to create a activation link will be valid passwordfor the user in ''number of hours. ''
* '''Note: '''The best challenge questions will have answers that are simple, memorable, not easy to guess, and will not change over time.
* '''Note: '''An organization will display informational text at the top saying that its password policies have not been configured until they are.
{| class="wikitable"
|-
||For when a new user is sent their password for the first time
||
* If the password activation settings have a '''default security code '''but no challenge questions, the user will be prompted to enter the default security code.
* If the password activation settings have a '''default security code '''and '''challenge questions, '''the user will be prompted to enter the default security code and then taken to a second screen to define an answer to one of the challenge questions. The user can then go their [[Profile]] and access the '''Change Password '''page to view and update their stored challenge question and answer.
* The user will be presented with reCAPTCHA validation in all cases.
|}After a user has successfully completed the appropriate password activation process, they will be logged into that SmartSimple [[Image:Password-Activation-Settings.pnginstance]]and their newly created password will become active.
====Custom Policy====* The '''Default Security CodeCompose Custom Password Policy''' - A hard-coded table provides the ability to define the custom password policy that matches your organization's security standards and provides control of each character type desired (upper case, lower case, numeric and/or symbols). You can also specify the minimum number of characters required for that character type.* The character mask used to define your selection will appear in the '''Custom Password Policy''' field. You can also write your own code and paste it into this field if desired.* The '''Validate Pattern''' button will open a window where you can test various passwords against the policy to see if they will pass or fail.* The value in the '''Custom Password Policy Description''' field will be displayed to be entered users when users request new passwordssetting/changing their password. You can use plain text or html in this field (For example, to insert a line break use ''<br>'')* '''Note''': See also [[Custom Password Policy Examples]][[Image:Custpwpolicy.png]]
<pre style="white-space: [[Image-o-pre-wrap; word-wrap:Challengebreak-question.png|link=]]: word;"><!--@sslogic('@langid@'='Note:2''' An example of a good challenge question would be something that is simple, memorable, can't be guessed easily, and won't change over time.===Rules for Password Activation Settings===When a company has password settings configured, then these will be used in full. When a company does not have password settings configured, the )--><br>@system will go up the Organizational hierarchy until it finds a parent company with password settings configured and then use these settings. NOTE: When a company does not have password settings configure it will display informational text at the top saying it has not been configured. The following rules apply to the above settings when a '''new user is sent their password for the first time''': * If the Activation settings have a default security code but no challenge questions, the user will be prompted to enter the default security code.* If the Activation settings have a default security code and a challenge questions, the user will be prompted to enter the default security code and then taken to second screen to define an answer to one of the the Challenge questions. The user can then go User Profile and access the Change Password page to view and update their stored challenge question and answer.* The user will be presented with [[CAPTCHA]] validation in all cases. The following rules apply to the above settings when an '''existing user requests a new password''': * If a default security code has been entered and no challenge questions have been entered, the user will be prompted to enter the default security code.* If a default security code has been entered and challenge questions have been entered, the user will only be prompted to answer a challenge question.* The user will be presented with [[CAPTCHA]] validation in all cases. After successful completion of Password Activation, the user will be logged in and their new password will be active. ===Intruder Lockout Settings===[[image:passwordPolicy - French@<!--@else-006.png]] These settings determine the actions that should be taken if someone attempts to log into your copy of [[SmartSimple]]. * '''Number of Attempts''' – the number of attempts to log in with an account before the account is locked. * '''Lockout Duration''' – the duration of the account lockout. The [[User|user]] will not be able to log in during this period. Period can be set to 5 minutes, 15 minutes, 30 minutes, 1 hour, 3 hours, 12 hours, 24 hours or forever (until unlocked by [[Administrator|administrator]]). * '''Lockout Message''' - a custom message to display to users when a user is locked out due to too many failed login attempts. This message will only display when a user has been locked out, and attempts to log in again with the correct password. Therefore, no information will be divulged to users that fail their login. * The '''View Locked Users''' tab will display all [[User|users]] that have had their account locked><br>@system. * If a user is locked, you can click on the '''Set Password''' button on the '''View Locked Users''' tab to reactivate the account and send the [[User|user]] a new [[Password|password]]. * ''Once an account has been locked for exceeding the number of permitted login attempts it will remain on the "locked users" list until the correct password is entered. This allows the administrator to see which users have been unable to log in, even if the configured lockout duration has passed and the account is no longer technically locked.'' * ''When an account has been locked for exceeding the allotted number of attempts, after the lockout time has passed they are permitted only one attempt at the correct password. A single incorrect password at this point will rePolicy@<!--lock the account for the configured lockout duration. In other words, once someone is on the "locked user" list they are only permitted a single wrong attempt and they will be locked for the lockout duration again. This prevents would@end-be intruders from having multiple attempts to guess the password each time the lockout duration has passed. '' ===Password Reset Message===[[image:password-005.png]] This feature provides the ability to overwrite the standard Password Reset message with a custom message for your organization. ></pre>===Intruder Lockout Settings and Intruder Email Alert===These settings define who should be informed by email if an intruder alert is detected. A default emial template is used and contains the following values: [[File:10-12-2016 1-15-24 PM.png]] The Default template uses the primary contact on the root company record to populate the third tab in '''Email To'''. You can save the default template Password and then modify ifrequired. * '''Email From''' – the “from” address for the email. If you do not set this valueActivation Policies, the address: '''donotreply@smartsimple.com'' ' will be used.* '''Email To''' – select the [[Internal|internal]] people to receive the email.* '''Subject''' – the subject of the email. See below for the variables that you can use in the subject.* '''Body''' – the body of the alert email. See below for the variables that you can use in the body. called '''Intruder Alert Email Variables''' – because the [[User|user]] is not logged into the systemSettings, the amount of information available is limited to IP Address '''@ip@''', will determine the attempted username '''@username@''' and date/time '''@now@''' of the attempted login. ===Intruder Log===The '''View Log''' tab is used actions that should be taken if someone attempts to access the '''Intruder Alert''' log. [[Image:Glob13.png]] * The list can be sorted by clicking the column title.* You can filter the list by [[Username|username]], year, and month. ===Hierarchical Password Policy===When viewing a company in into your hierarchy, select '''Settings > Password Policy''' to define. <br/><br/> A different password policy can be defined for each company within the system. <br/><br/> If there are password policies defined for a company then it will automatically apply to all sub-companies in the copy of [[Creating_an_Organization_Chart_and_Company_Hierarchy|hierarchySmartSimple]], unless those sub-companies have defined their own password policy. <br/><br/> If there are no password policies defined for a company, then the system will look at the companies above it in the hierarchy, and if one of these parent companies have a password policy set then it will use these settingsbut cannot provide accurate credentials. <br/><br/>
* Options: 5 minutes, 15 minutes, 20 minutes, 1 hour, 3 hours, 12 hours, 24 hours or Forever* ''NOTE'Note: '''If the ''' There are Forever '''option is selected for the lockout duration, the user will have no settings stored in the database for a company until someone actually opens access to login ''until ''manually unlocked by the Password Policy page for that company and clicks Save.[[Global User Administrator|System Administrator]]
{| class="wikitable"|-||'''Email From'''||The From Address for the email alert. If you do not manually set this value, then the address '''donotreply@smartsimple.com '''will be used.|-||'''Email To'''||Select the [[Image:ViewLockedUsers.png|1000pxInternal]]people to receive the email alert. Click the '''binoculars icon '''for a full list of internal staff, from which you can select who to send the email alert to.
Once an account has been locked for exceeding the number of permitted login attempts, it will remain on the '''Locked Users '''list until the correct password is entered. This allows the SysAdmin to see which users have been unable to log in, even if the configured lockout duration has passed and the account is no longer technically locked.
* Once an account has been disabled as a result of overly long inactivity, the user will remain on this list until their password is reset. This allows the SysAdmin to see which users have had their accounts disabled because of inactivity.* If a an inactive user is expireddisabled, you can click on the there will be a '''Send PasswordPassword ''' button next to reactivate their name on this tab - that way, you can reactive the account and send the [[User|user]] a new [[Password|password]]with which they can log into the system.
==Single Sign-On==
