> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/administration-guide/reference/policy-parameters.md). # Password and authentication policy parameters Every password and authentication policy parameter, its validation handler, and the values the default shipped policies use. ## What this is, and when you need it A policy is a set of parameter values. The parameter *definitions* live in `POLICY_DEF_PARAM` (**59** of them); the *values* for a given policy live in `POLICY_ATTRIBUTE`. Use this page when you are writing a password requirement and need to know whether OpenIAM has a parameter for it, and what the shipped policy already does without you. Two policies ship: **`4000`** (the default password policy) and **`4001`** (the default authentication policy). `4000` is editable at **Policy → Password Policy** and `4001` at **Policy → Authentication Policy**; the parameter names below are the ones the policy screen groups its fields under. The **validation handler** column is the handler name recorded against the parameter definition in `POLICY_DEF_PARAM`. No Webconsole screen shows it — a read-only `SELECT` against that table is the only way to see it on a running system — and it is listed here because it is what separates a parameter that is *checked when a password is submitted* from one that is merely *stored*. A parameter showing `—` has no handler, so nothing rejects a password on account of it; whatever behaviour its name describes is either enforced somewhere else in the product, like expiry and lockout, or not enforced at all. Before you rely on any `—` parameter, set a password that should violate it and see whether OpenIAM refuses. ## Parameters by group ### Password composition Group value: `PSWD_COMPOSITION` — 18 parameters. | Param ID | Name | Description | Validation handler | Policy 4000 | | ------------------- | ----------------------------- | --------------------------------------------------------------------- | --------------------------------- | -------------------------- | | `117` | `ALPHA_CHARS` | Alpha character(Min-Max) | `AlphaCharRule` | *(empty string)* | | `IDEOGRAPHIC_CHARS` | `IDEOGRAPHIC_CHARS` | Accept Ideographical Characters | `IdeographicCharsRule` | *(empty)* | | `184` | `INITIAL_PASSWORD` | Initial Password configuration | — | `STATIC` – `STATIC,RANDOM` | | `182` | `LIMIT_NUM_REPEAT_CHAR` | Limit the repetition of same character | `LimitNumberRepeatCharRule` | *(empty)* | | `115` | `LOWERCASE_CHARS` | Lowercase characters(Min-Max) | `LowerCaseRule` | *(empty)* | | `MIN_CHARS_CHANGED` | `MIN_CHARS_CHANGED` | Minimum Characters which must be different from the previous password | `PasswordCharacterRepetitionRule` | `10` | | `180` | `MIN_WORDS_PASSPHRASE` | Minimum number of words in the phrase | `PassphraseMinWordsRule` | *(empty string)* | | `116` | `NON_ALPHA_CHARS` | Non-alpha numeric symbols(Min-Max) | `NonAlphaNumericRule` | *(empty)* | | `113` | `NUMERIC_CHARS` | Numeric characters(Min-Max) | `NumericCharRule` | `1` | | `138` | `PWD_EQ_PWD` | RejectPassword Equals password | `PasswordNotPasswordRule` | *(empty)* | | `110` | `PWD_HIST_VER` | Password history versions | `PasswordHistoryRule` | `6` | | `112` | `PWD_LEN` | Password length | `PasswordLengthRule` | `8` – `12` | | `121` | `PWD_LOGIN` | Reject password = Login Id | `PasswordNotPrincipalRule` | *(empty)* | | `122` | `PWD_NAME` | Reject password = First / Last name | `PasswordNotNameRule` | *(empty)* | | `170` | `REJECT_CHARS_IN_PSWD` | Characters not allowed in a password | `RejectCharactersRule` | `<>` | | `185` | `REJECT_WORDS_IN_PSWD` | Words not allowed in a password | `RejectWordsRule` | `false` | | `181` | `REPEAT_SAME_WORD_PASSPHRASE` | Repetition of the same word in the phrase | `PassphraseRepeatWordRule` | *(empty string)* | | `114` | `UPPERCASE_CHARS` | Uppercase characters(Min-Max) | `UpperCaseRule` | *(empty)* | ### Other parameters Group value: `(ungrouped)` — 15 parameters. | Param ID | Name | Description | Validation handler | Policy 4000 | | -------- | ------------------------ | --------------------------------- | ------------------ | ----------- | | `151` | `AUTO_UNLOCK_TIME` | UnLock account in n minutes | — | — | | `174` | `BASEDN` | Type of authentication module | — | — | | `157` | `FAILED_AUTH_COUNT` | Failed Authentication Attempts | — | — | | `155` | `FAIL_URL` | URL to forward on authn fail | — | — | | `172` | `HOST_LOGIN` | Login to the host | — | — | | `173` | `HOST_PASSWORD` | Password to the host | — | — | | `179` | `HOST_URL` | URL of the host system | — | — | | `176` | `KEY_ATTRIBUTE` | Name of the Primary Key Attribute | — | — | | `153` | `LOGIN_MODULE_SEL_POLCY` | Policy to select the login module | — | — | | `163` | `LOGIN_MOD_TYPE` | Type of authentication module | — | — | | `178` | `MANAGED_SYS_ID` | Managed system Id | — | — | | `175` | `PROTOCOL` | Protocol | — | — | | `154` | `SUCCESS_URL` | URL to forward on authn success | — | — | | `162` | `TOKEN_ISSUER` | Issuer of the SSO Token | — | — | | `159` | `TOKEN_LIFE` | SSO Token Type Life | — | — | ### Forgotten-password and recovery Group value: `FORGET_PSWD` — 15 parameters. | Param ID | Name | Description | Validation handler | Policy 4000 | | ------------------------------- | --------------------------------- | ----------------------------------------------------------------------- | ------------------ | ----------- | | `ACCOUNT_LOCK_TIME` | `ACCOUNT_LOCK_TIME` | Account Lock Time | — | `15` | | `187` | `CUSTOM_QUEST_ANSWER_COUNT` | Answers for user questions | — | `3` | | `186` | `CUSTOM_QUEST_COUNT` | User questions count | — | `3` | | `188` | `FAILED_QUESTION_COUNT` | User failed question answers count | — | `3` | | `192` | `FAIL_ATTEMPTS_HELPDESK` | Number of allowed incorrect answers for Helpdesk questions | — | `3` | | `MAX_OTP_RESEND_ALLOWED` | `MAX_OTP_RESEND_ALLOWED` | MAX OTP Resend Allowed | — | `3` | | `MIN_ANSWER_LENGTH` | `MIN_ANSWER_LENGTH` | Min answer length for security questions | — | `1` | | `NUM_DAYS_FRGT_PWD_TOKEN_VALID` | `NUM_DAYS_FORGET_PWD_TOKEN_VALID` | Number of days the forgot password token is valid | — | *(empty)* | | `190` | `OTP_SMS_LIFETIME` | SMS OTP Lifetime | — | `30` | | `171` | `QUEST_ANSWER_CORRECT` | Number of answers that are required to be correct | — | `3` | | `130` | `QUEST_COUNT` | Number of questions to display | — | `3` | | `132` | `QUEST_LIST` | Question list | — | *(empty)* | | `131` | `QUEST_SRC` | Source of questions | — | `USER` | | `191` | `REQUIRED_HELPDESK_QUESTION` | Number of required question to give access to user profile for helpdesk | — | `2` | | `189` | `USER_DRIVEN_RESET` | User may choose how password will be reset | — | `false` | ### Password change rules Group value: `PSWD_CHANGE_RULE` — 11 parameters. | Param ID | Name | Description | Validation handler | Policy 4000 | | ------------------------------- | ------------------------------- | ----------------------------------------------------------------- | --------------------------- | ----------- | | `118` | `CHNG_PSWD_ON_1ST_LOGIN` | Change Password on the 1st Login | — | `true` | | `134` | `CHNG_PSWD_ON_RESET` | Change Password after reset | — | `1` | | `MAX_RETRIES_VALIDATE_PASSWORD` | `MAX_RETRIES_VALIDATE_PASSWORD` | Maximum retries for validate password | — | `10` | | `142` | `PASSWORD_CHANGE_ALLOWED` | Determines how many times you are allowed to change your password | `PasswordChangeAllowedRule` | `1` | | `PASSWORD_NEVER_EXPIRE` | `PASSWORD_NEVER_EXPIRE` | Password never expire | — | `false` | | `PASS_COMPROMISED_CHECK` | `PASS_COMPROMISED_CHECK` | Check if password has been compromised | — | `true` | | `111` | `PWD_EXPIRATION` | Password expiration | — | `90` | | `141` | `PWD_EXPIRATION_ON_RESET` | Password expiration time on reset | — | `2` | | `133` | `PWD_EXP_GRACE` | Password expiration grace period | — | `1` | | `129` | `PWD_EXP_WARN` | Days to password expiration warning | — | `2` | | `139` | `RESET_BY_USER` | Reject reset by user | `ChangePasswordByUserRule` | *(empty)* | ## What the default password policy actually enforces The values above are the shipped state of policy `4000`. Read them before you write a customer requirement: several defaults surprise people. * Password length is a **range**, not a minimum. * Expiration, warning and grace are three separate parameters and are all set out of the box. * `REJECT_CHARS_IN_PSWD` ships with a value — some characters are already rejected. * Security-question count and required-correct-count are separate parameters, and both ship at 3. * The compromised-password check ships **enabled** on policy `4000`. Documentation that tells an administrator to switch it on is describing an older release. {% hint style="info" %} A validation handler is shipped behaviour, not a configurable expression, so you cannot express an arbitrary password rule by editing a policy — a genuinely new rule is a product change, not a configuration change. The `RegularExpression`-typed *system properties* validate other fields (login, first name, last name), not passwords, so do not reach for them expecting to constrain a password. {% endhint %} ## Authentication policy 4001 Policy `4001` stores values against parameter IDs; match each ID to its name in the tables above. | Param ID | Value | | -------- | ----------------------------------------------------------------------------------------------------------------------------- | | `151` | `30` | | `152` | `OPENIAM_TOKEN` | | `153` | *(empty string)* | | `154` | *(empty string)* | | `155` | *(empty string)* | | `157` | `3` | | `158` | `org.openiam.idm.srvc.auth.spi.DefaultLoginModule` — the login module the policy authenticates with, quoted exactly as stored | | `159` | `30` | | `162` | `openiam` | | `163` | `1` | | `164` | *(empty)* | | `178` | `0` | This is where lockout thresholds and auto-unlock timing are set: `157` is the failed-attempt count that locks an account and `151` is the number of minutes after which it unlocks itself, so out of the box three bad passwords lock an account for thirty minutes. Confirm both on **Policy → Authentication Policy** before telling a helpdesk what to expect — a deployment that has raised or removed the count will not lock at three. *Applies to OpenIAM 2026.8.1. Last reviewed 7 August 2026.* --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.openiam.com/administration-guide/reference/policy-parameters.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.