Password policies

Password policies define the password requirements for your users. A password policy is a set of rules that encourage users to create strong passwords and use them properly. A password policy is often part of an organization's official regulations and might be taught as part of security awareness training. The password policy can either be advisory or mandated by technical means.

The OneWelcome Identity Platform supports password policies that are considered commonly-accepted best practices. When commonly-accepted password policies are not considered sufficiently secure, you can use two-factor authentication (2FA) to enhance security.

Changing the password policy does not trigger a password migration process. Instead, the new password policy applies whenever a user sets a new password.

Password complexity

The OneWelcome Identity Platform applies industry standard password rules that are considered best practices by commonly-used identity stores. It rejects passwords that include the username or that are the same as the formattedName.

It is a best practice to not allow spaces in passwords, although the OneWelcome Identity Platform supports passwords that contain spaces.

Password history

The password history policy determines the number of unique new passwords that a user account must have before an old password can be reused. For every user, the OneWelcome Identity Platform keeps a password history that any new password is checked against. For security purposes, passwords are stored in a hashed format.

Password reuse is an important concern in any organization, because many users want to reuse the same password for their account over a long period. The longer the same password is used for a user account, the greater the risk that an attacker can determine the password through brute force attacks. If users are required to change their password, but can reuse old passwords, the effectiveness of a good password policy is greatly reduced.

Configure the password policy

1. Log in to your OneWelcome Identity Platform and select your tenant, if required.

2. In the top-right of your browser, in the Applications menu, select Configuration.

3. On the OneWelcome Identity Platform console, select Core > Password policy.

   

4. Enter the Password rules:

   • Minimum character length: Specify the minimum password length. NIST Digital Identity Guidelines recommend a minimum length of at least eight characters.

   • Required minimum categories: Specify the minimum number of character categories that a password must include.

5. Enter the Required minimum characters. For each category, specify the minimum number of characters that a password must include.

   • Lowercase
   • Uppercase
   • Special
   • Digits

   It is a best practice to not allow spaces in passwords.

6. Enter any Forbidden characters that passwords are not allowed to include:

   

   • Leading
   • Trailing

7. Enter the Expiration:

   

   • Days of password validity:

   • Ask users to change password (in days):

8. Enter the Password history:

   

   • Enabled: Select Yes or No.

   • Days of maximum history: The default password history maximum is 100 days. After the maximum number of passwords are stored, the OneWelcome Identity Platform purges the oldest passwords.

   • Hashing algorithm: The OneWelcome Identity Platform supports the following hashing algorithms:

     • 3DES
     • AES
     • BASE64
     • BLOWFISH
     • CLEAR
     • CRYPT
     • MD5
     • PBKDF2
     • RC4
     • SHA
     • SMD5
     • SSHA
     • SSHA256
     • SSHA384
     • SSHA512
     • RSSHA1
     • RSMD5

   • Prohibited password history: Specifies the number of passwords that users cannot reuse. The default is 10.

   • Prohibited reuse duration (in days): Users cannot reuse any password that was set during this period (in days). The password history period is set to 365 days (one year) by default.

9. Select Save.