Smartstaff, administrator
60
edits
Changes
no edit summary
==Overview=='''Password PolicyPolicy ''' is used to control configure the length and complexity of passwords, password expiration and history, the number of retries that the policies within [[User|userSmartSimple]] with your organizational standards. It is allowedbest practice to ensure that these policies match the other systems deployed by your organization; consequently, and the lockout time these policies allow for the account if they exceed the number of retriesextensive configuration options.
Multiple password policies can be supported by the system. This feature provides for less stringent policies for types of users that ''infrequently ''access the system - for example, [[External]] contacts who would only use the system for an application. Alternative password policies can be set for any level in the [[Organization hierarchy|organization hierarchy]].
You can also set individual password policies for the different companies of your organization hierarchy. However, they will be able to ''edit ''the policy only, and not edit the [[Email#Email Templates for User Activation and Password|the Activation Emails]], which can only be configured from [[Global Settings]] by a [[User|user]] with [[Global User Administrator|System Administrator]] [[User Role|privileges]].
: '''Password lengthNote: '''In all cases of password policies, '''common words '''or '''known common passwords ''' – the minimum length allowed for a are ineligible to be used as [[Password|passwordSmartSimple]], between 6 and 32 characterspasswords. ==Configuration - Essentials=====How to Access the Password Settings===1. Click on the 9-square menu icon on the top right of your page.
==Intruder Lockout =Password Settings===This section, under the first tab of the '''Password and Activation Policies '''labelled '''General, '''is used to set password attributes.
* '''Lockout DurationNo Restriction - ''' – any character can be used; this is the duration of default. * '''Alpha Only - '''only letters are able to be used.* '''Alpha & Numeric - '''both letters and numbers must be used in the account lockoutpassword. The [[User|user]] will not * '''Alpha & Numeric & Special Characters - '''a combination of letters, numbers, and special characters must be able to log in during this periodused. Period * '''Custom Policy - '''a password policy can be set to 5 minutes, 15 minutes, 30 minutes, 1 hour, 3 hours, 12 hours, 24 hours or forever (until unlocked by [[Administrator|administrator]])custom-defined.
* '''Note: '''This first login does not count towards the Maximum Password Update in 24 Hours setting.
|-
||'''Password Expiration'''
||Each user will be forced to change their password once the selected number of days has passed. Doing so every quarter or so is good security practice; however, any number of days can be set. On each login, the system will check how many days until the password expires and will notify the user their password is about to expire in X days.
|-
||'''Password History Check'''
||You can set the number of previous passports (to a maximum of 32) that the system will remember for each user. When changing their password, users will not be permitted to re-use a previous password that is remembered by the '''Password History '''until the specified number of unique passwords have been used.
|-
||'''Maximum Password Changes in 24 Hours'''
||
This will set the maximum number of password changes any individual user is able to make within a 24-hour period. This is to prevent users from bypassing the password history restriction by changing their password repeatedly in order to return to a previously used password.
'''Intruder Alert Email VariablesOrganization Field ''' – because the - Both [[UserStandard Fields|userstandard]] in not logged into the system the amount of information available is limited to IP Address '''@ip@''', the attempted username '''@username@''' and time '''@time@'''[[Custom Fields|custom fields]] are supported.
'''Contact Field '''- Both [[Standard Fields|standard]] and [[Custom Fields|custom fields]] are supported.
|}==Intruder Log==Disable Inactive Accounts and Activation Settings====Scrolling down further on the '''General '''password settings page will bring you to the sections that allow you to set the criteria for disabling and activating accounts.
:: [[ImageFile:Glob13Password disable and activate.png|500px|border]]{| class="wikitable"|-||'''Disable user accounts after ''X ''days'''||Insert the number of days a user account is inactive before it is disabled. In order to disable this feature, simply leave the field blank.|-||'''Apply Policy to All Sub-Companies'''||Click this button to force-update the password policy related to the current organization and all sub-companies.
|-
||'''Disabled Inactive Account Message'''
||Write in the text that will be displayed when a user is attempting to access an expired account.
|-
||'''Enable reCAPTCHA Validation'''
||
|-
||'''Activation link life span'''
||
This function works with the @activationlink@ [[Password Variables to Set or Reset User Passwords|password variable]]. If the '''https://@url@@activationlink@ '''syntax is used in the '''Request Password '''section of [[Email#Email Templates for User Activation and Password|email templates]], this setting sets the duration that the activation link will be valid for the user in ''number of hours. ''
* When an account has been locked for exceeding the alloted number of attempts'''Note: '''The best challenge questions will have answers that are simple, memorable, after the lockout time has passed they are permitted only one attempt at the correct password. A single incorrect password at this point will re-lock the account for the configured lockout duration. In other wordsnot easy to guess, once someone is on the "locked user" list they are only permitted a single wrong attempt and they will be locked for the lockout duration again. This prevent would-be intruders from having multiple attempts to guess the password each not change over time the lockout duration has passed.
: ''In what city or town was your first job?;''<br />''What is your mother's maiden name?;''<br />''What was your first pet's name?;''<br />''In what year was your father born? ''
|}
====Password Reset Message====
Even further down at the bottom of the '''General '''page of '''Password and Activation Policies '''are features relating to a '''Password Reset Message '''and '''Persistent Login. '''
:: [[File:Password reset message custom.png|800px|border]]
In the text field box, write the content for the '''Reset Password '''message that a user will see if they need to reset their password. You may select between a default template or you may choose to make it custom.
====Persistent Login====
:: [[File:Persistent login.png|600px|border]]
The '''Persistent Login''' functionality provides for the use of a persistent secure cookie on the [[SmartSimple]] [[User|user]]'s computer to eliminate the need to use a username and password to log into the system.
Rather than having to log in to SmartSimple each time you open your web browser, a "cookie" can be installed on your computer that will automatically authenticate you, allowing you to bypass the login screen. (This setting can be [[System_Security_Permissions#Miscellaneous_Feature_Permission|enabled or disabled]] by your system administrator). In order for this feature to work, you must have the user's browser enabled to accept persistent cookies.
====Rules for Password Activation Settings====
When an organization has their password settings configured, then they will be used in full.
When an organization does not have their password settings configured, the system will go up the [[Organization hierarchy|organization hierarchy]] until it finds a parent company with password settings configured, and by default it will allow the organization to inherit those settings. '''Example: '''If only the [[The Root Company|root organization]] has its password settings configured, all other organizations would inherit the same policies, as they all fall under the root organization on the organization hierarchy.
* '''Note: '''An organization will display informational text at the top saying that its password policies have not been configured until they are.
{| class="wikitable"
|-
||For when a new user is sent their password for the first time
||
* If the password activation settings have a '''default security code '''but no challenge questions, the user will be prompted to enter the default security code.
* If the password activation settings have a '''default security code '''and '''challenge questions, '''the user will be prompted to enter the default security code and then taken to a second screen to define an answer to one of the challenge questions. The user can then go their [[Profile]] and access the '''Change Password '''page to view and update their stored challenge question and answer.
* The user will be presented with reCAPTCHA validation in all cases.
|-
||For when an existing user requests a new password
||
* If the password activation settings have a '''default security code '''but no challenge questions, the user will be prompted to enter the default security code.
* If the password activation settings have a '''default security ''''''code '''and '''challenge questions, '''the user will only be prompted to answer a challenge question.
* The user will be presented with reCAPTCHA validation in all cases.
|}
After a user has successfully completed the appropriate password activation process, they will be logged into that SmartSimple [[instance]] and their newly created password will become active.
====Custom Policy====
* The '''Compose Custom Password Policy''' table provides the ability to define the custom password policy that matches your organization's security standards and provides control of each character type desired (upper case, lower case, numeric and/or symbols). You can also specify the minimum number of characters required for that character type.
* The character mask used to define your selection will appear in the '''Custom Password Policy''' field. You can also write your own code and paste it into this field if desired.
* The '''Validate Pattern''' button will open a window where you can test various passwords against the policy to see if they will pass or fail.
* The value in the '''Custom Password Policy Description''' field will be displayed to users when setting/changing their password. You can use plain text or html in this field (For example, to insert a line break use ''<br>'')
* '''Note''': See also [[Custom Password Policy Examples]]
[[Image:Custpwpolicy.png]]
'''Important:''' When defining a custom password policy be sure to provide a detailed description of the policy in the '''Custom Password Policy Description''' field so that users are aware of the minimum requirement to enable them to create a valid password.
If you need to translate the '''Custom Password Policy Description''' message you can use [[sslogic]]. It is often easiest to use [[System Variables]] for these. Example:
<pre style="white-space: -o-pre-wrap; word-wrap: break-word;"><!--@sslogic('@langid@'='2')--><br>@system.Password Policy - French@<!--@else--><br>@system.Password Policy@<!--@end--></pre>
===Intruder Lockout Settings and Intruder Email Alert===
The third tab in '''Password and Activation Policies, '''called '''Intruder Alert Settings, '''will determine the actions that should be taken if someone attempts to log into your copy of [[SmartSimple]] but cannot provide accurate credentials.
:: [[File:Intruder alert settings new.png|600px|border]]
{| class="wikitable"
|-
||'''Number of Attempts'''
||Enter a number from 1-32 that will denote the amount of times someone can ''attempt ''to log in with an account (that is, with an incorrect password) before that account is locked.
|-
||'''Lockout Duration'''
||
Select from a number of options the duration of the account lockout. Within this period, the user will have no ability to log in, even if their credentials are correct.
* Options: 5 minutes, 15 minutes, 20 minutes, 1 hour, 3 hours, 12 hours, 24 hours or Forever
* '''Note: '''If the '''Forever '''option is selected for the lockout duration, the user will have no access to login ''until ''manually unlocked by the [[Global User Administrator|System Administrator]]
|}
The latter half of this page has the heading '''Intruder Email Alert - '''using a default template, it allows you to customize the email alert when someone has been locked out because of intruding attempts.
{| class="wikitable"
|-
||'''Email From'''
||The From Address for the email alert. If you do not manually set this value, then the address '''donotreply@smartsimple.com '''will be used.
|-
||'''Email To'''
||
Select the [[Internal]] people to receive the email alert. Click the '''binoculars icon '''for a full list of internal staff, from which you can select who to send the email alert to.
* '''Note: '''The Default Template will use the [[Organization hierarchy#Organization Ownership|primary contact]] of the [[The Root Company|root organization]] to populate the '''Email To '''field.
|-
||'''Subject'''
||The subject of the email.
|-
||'''Body'''
||'''Sample Template - '''Clicking this will populate the text window automatically with a template of what the email alert will contain. It will include [[System Variables]].
|}
'''Intruder Alert Email Variables''' – because the [[User|user]] is not logged into the system, the amount of information available is limited to IP Address '''@ip@''', the attempted username '''@username@''' and date/time '''@now@''' of the attempted login.
===Locked Users===
The '''Locked Users '''tab will display a [[List View Overview|list]] of all users that have had their account locked.
:: [[File:Locked user lists.png|800px|border]]
If a user is locked, you can click on the '''Set Password''' button on the '''View Locked Users''' tab to reactivate the account and send the [[User|user]] a new [[Password|password]].
Once an account has been locked for exceeding the number of permitted login attempts, it will remain on the '''Locked Users '''list until the correct password is entered. This allows the SysAdmin to see which users have been unable to log in, even if the configured lockout duration has passed and the account is no longer technically locked.
When an account has been locked for exceeding the number of permitted login attempts, after the lockout time has passed they are permitted only ''ONE ''attempt at the correct password.
* A single incorrect password at this point will '''re-lock '''the account for the configured lockout duration.
* This is a preventative measure so that would-be intruders do not have multiple attempts to guess the password each time the lockout duration has passed.
===Disabled Inactive Users===
This function is only available from '''Global Settings > Security > Password and Activation Policies; '''it is not accessible from individual password policies for the different companies in your [[Organization hierarchy|organization hierarchy]].
:: [[File:Disabled inactive users.png|800px|border]]
Similarly to the '''Locked Users '''tab, the '''Disabled Inactive ''''''Users '''tab will provide a [[List View Overview|list]] of all expired [[User|users]] in your system. Their accounts have expired as a result of inactivity and a disabling that can be configured after a certain amount of time (see [[Password Policy#Disable Inactive Accounts and Activation Settings|Disable Inactive Accounts]].
* Once an account has been disabled as a result of overly long inactivity, the user will remain on this list until their password is reset. This allows the SysAdmin to see which users have had their accounts disabled because of inactivity.
* If an inactive user is disabled, there will be a '''Send Password '''button next to their name on this tab - that way, you can reactive the account and send the user a new password with which they can log into the system.
==Single Sign-On==
For information on the Single Sign-On settings and functionality, please refer to the [[Single Sign-On]] page.
=See Also=
* [[Custom Password Policy Examples]]
* [[Password Variables to Set or Reset User Passwords]]
[[Category:Global Settings]][[Category:Security]][[Category:System Auditing]]
