Validation regular expressions

OpenIAM validates user input for email addresses, login names, first names, and last names using configurable regular expressions, ensuring that all identity data entering the system is clean, consistent, and compliant with organizational policies. These patterns are set globally and applied across the entire system — in the Webconsole, SelfService portal, and provisioning flows.

The feature can be configured by navigating to Webconsole > Administration > System Configuration > System tab.

Scroll down to find the four regular expression (regex) fields.

Fields

Email Regular Expression

The field controls what is considered a valid email address throughout OpenIAM.

The default value accepts any string that has no whitespace or @ before the @, followed by a domain containing a dot. Simple and permissive, but missing the ^ anchor — a multiline input could bypass it.

The recommended checks the following matches.

Examples:

Login regular expression

This expression controls what characters are allowed in a user's login (username).

The key difference here is * vs +. The default uses * (zero or more), which means an empty string passes validation. Change to + (one or more) to require at least one character.

Allowed characters (both patterns):

Examples:

First name regular expression

These control what characters are allowed in a user's first name.

In the default patterns, digits (0-9) and underscore (_) are unusual in personal names. More importantly, it uses * so an empty first name passes. The pattern also does not allow spaces, hyphens, or apostrophes — which are common in real names (Mary-Jane, O'Brien).

The recommended pattern covers the following.

Examples:

Last name regular expression

The last name field controls what characters are allowed in a user's last name. Same considerations as for the First Name apply.

The same recommended pattern as first name applies here. Last names share the same real-world formatting needs: hyphens (Smith-Jones), apostrophes (O'Connor), and spaces (Van Der Berg).

Updating the regex fields

In the event the regex fields need to be updated, follow the steps below.

1. Navigate to Webconsole > Administration > System Configuration > System tab.
2. Locate the regex field you want to update.
3. Clear the existing value and paste the new regular expression.
4. Click Save.
5. Test immediately by creating or editing a user with sample inputs — see the testing section below.

Testing regex fields

Before applying any regex field expression, make sure to test their work to prevent unintended side effects and ensure the rules behave exactly as expected. Use one of the following methods to validate a regex pattern before saving it in OpenIAM.

Online tester

Go to regex101.com, select Java flavour (as OpenIAM backend uses Java), paste your pattern, and test it against sample inputs.

Groovy one-liner

Groovy matches OpenIAM's engine and hence can be used for testing in this regard.

def pattern = /^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/
def testInputs = [
    "user@example.com",
    "user@state.mn.us",
    "bad input",
    "@nodomain.com",
    "user@domain"
]
testInputs.each { input ->
    println "${input.padRight(30)} -> ${input.matches(pattern) ? 'VALID' : 'INVALID'}"
}

Quick bash test

Use the following bash option to quickly test your regex pattern against sample input, ensuring it matches expected values and rejects invalid ones before applying it system-wide.

echo "user@example.com" | grep -P '^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$'

Quick reference

You can also use the following table for a quick reference across regex fields in OpenIAM.