Password Policies

Conditional- Password Rule should be conditional if the check box is checked.

                      Note:-This will be enabled when "Quorum" is selected

Minimum number of upper case letters - The lowest allowable number of upper case letters to be used in passwords. A blank or zero (0) entry indicates that no upper case letters are required.

 Note:-The Require mixed case check box must be selected.

Disallow words found in dictionary when:
Disallows using actual words (house, runner, etc.) in passwords.Password cracking programs attempt to guess passwords by trying
words found in a dictionary. Dictionary word checking is case insensitive(i.e., "house", "hOUse", and "HOUSE" are treated as the same word).

Note:- Go to the Dictionary page to learn how to add words to the dictionary (thereby disallowing their use in passwords), and to remove words from the dictionary (thereby allowing their use in
passwords).

Additional

Password cracking programs often attempt to guess passwords by trying known information about the user such as first name, last name, ID, etc.

User Related

Password cracking programs often attempt to guess passwords by trying known information about the user such as first name, last name, ID, etc. Testing is case insensitive. Names, user IDs, and passwords are converted to lowercase before testing.

Notes:
· The Admin UI Add Profile feature does not enforce the user ID part of this rule.
· The Self-Service Self-Registration feature only enforces the user ID part of this rule if the user ID attribute primary is present as one of the fields in the Self-Registration UI.
· This rule is only enforced for the Identity account and profile of the user.

Disallow reverse or circular shift of user name- Disallows using:
                                                                                 · Reverse of the user's name or ID for passwords (e.g., 14nhoj password for john41 user name).
                                                                                 · Circular shift of the user's name or ID for passwords (e.g., 1john4 password for john41 user name).

Quorum for conditional

Minimum Number of conditional rules to be satisfied- User can specify the number of conditional rules to be satisfied.(This is enabled when "Quorum" is selected)

Custom Password Policy

Clicking the plus or minus expands/collapses this section. Check the box if the standard policy settings are not sufficient for your password policy requirements. This policy will be enforced by Identity Password Manager at run time during reset password operations.

The custom policy must be written in JavaScript. Any text editor such as Notepad can be used to create it and then copy/paste the data into the Policy Script field. These are the requirements of custom policies:
· Must be written using JavaScript.
· Must return the string "true" or Boolean "True" if the password policy validation succeeded.
· If the custom password policy validation fails, it must return the error message as a string or the
  Boolean "False".

Note:-this example uses testPassword as the Function Name; any other name can be used.

/*
* testPassword() - invoked to see if the password conforms to a user defined policy.
* Called whenever a user's password is reset.
*
* Parameters:
*
* password - the password to be tested.
* locale - the preferred locale of any error message.
*
* Output:
* The function should return true if the password meets the user defined password policy.
* If the password does not meet the user defined policy, then the function should return
* a string that describes what is wrong with the proposed password.
*
*/
function testPassword( password, locale)
{
if (password == 'test')
{
if (locale.substr( 0, 2) == 'de')
return 'Das Passwort kann nicht getestet werden!';
else if (locale.substr( 0, 2) == 'es')
return 'Contrase?a no puede ser prueba!';
else
return 'Password cannot be test!';

}
/*
* The getAttribute( attribute) function is available to access any FUP mapped profile
* attributes of the user. If the attribute is not mapped, or is not set, then
* getAttribute() will return null.
*/
if (getAttribute('Job-Department') == 'Sales' && password.indexOf( 'Sales') != -1)
return 'Password cannot contain Sales.';
else
return true;
}
/*
* generatePassword() - invoked when the generate password button is clicked in the
* Admin UI.
*
* Parameters:
*
* password - contains the password generated by the standard password policy rules
* for this policy. The generatePassword() function can use this password as
* a starting point.
*
* Output:
* The function should return a password that meets the custom password policy. If
* Standard Password Policy rules are enabled, the password must also conform to
* those rules.
*
*/
function generatePassword( password)
{
// override any generated password and return a random number between 0 and 1.
password = Math.random();
return password;
}

• Select the Custom Password Policy check box on the Password Policy Details page. Enter the description and function name.
• Copy and paste your JavaScript code into the custom Policy Script field.
• Test the custom policy by clicking the Test button.
• On the Test Password Policy page, enter the password to be tested against the custom policy then click the Test button
• If policy validation succeeds, the message Password is valid displays. The entered password met the requirements in the custom JavaScript policy.
• If policy validation fails, the message displayed is based on the JavaScript logic and error
  message in the JavaScript code.