Password Policy

The password policy controls the following:

• Password composition.
• Frequency of change.
• SelfService forgot password configuration.

The sections below describe how to configure the password policy. To access the password policy configuration page, go to Policy > Password Policy. If you are new to OpenIAM, start by configuring the existing Default Password Policy instead of creating a new one.

Password Policy Overview

The general data of the password policy contains the following fields:

• Name
• Description
• Priority: A numeric value representing the priority of this policy. A higher number indicates a higher priority over policies with a lower number.
• Active/Not Active flag: If the policy is not active, it won't be used during the policy resolving process.

Password Policy Composition

This section of the page allows configuring the details of the required password composition. The description of each field is provided in the table below.

Forgot Password Parameter

This section of the page allows configuring the details of the forgot password parameters and steps to restore it. The description of the fields is given in the table below.

To disable security questions so that they won't be displayed during the first login, disable the following policies:

• Max number of fail attempts to answer Helpdesk questions.
• Number of answers that are required to be correct.

Password Change Rule

This section of the page allows configuring the details of changing the password. The description of the fields is given in a table below.

There is also a possibility to limit password validation attempts. Here, after the limit is reached, an error will be thrown:

Maximum limit for password validation for an identity reached.

User will again be able to validate this password after 10 minutes.

Note: On the 1st login, the user might be directly taken to challenge questions after entering the password on login, instead of being asked to change their password. This event might happen even if Change Password on the 1st Login? field is checked. To tackle this issue, make sure to set the PENDING_INITIAL_LOGIN status in the sync script for new users.

Multiple password policies

OpenIAM provides the capability to link multiple password policies to various objects such as roles, groups, organizations, managed systems and authentication policies. When a user sets/resets a password, a password policy resolver is called. The password policy with the highest priority is then applied.

Example:

• There are several password policies in OpenIAM: The Default Password Policy with a priority of 10; CustomPolicy1 with a priority of 14 (more restricted than the default password policy); _AD Password Policy_with a priority of 15.
• The following objects are in OpenIAM: The role Manager is linked to CustomPolicy1; the group AD Users is linked to AD Password Policy; the organization Sales Department is linked to Default Password Policy.
• The user John.Snow has a Manager role and is a member of the Sales Department organization.
• The user Sansa.Stark belongs to the AD Users group and is a member of the Sales Department organization.
• The user Arya.Stark has a Manager role and belongs to the AD Users group.

Appendix 1

Groovy script to generate random password

package org.openiam


import org.openiam.api.connector.groovy.AbstractIPolicyMapGroovy
import org.openiam.api.connector.model.ConnectorAttribute
import org.openiam.api.connector.model.StringOperationalConnectorValue
import org.openiam.base.AttributeOperationEnum
import org.openiam.base.response.list.PolicyListResponse
import org.openiam.common.beans.mq.PolicyRabbitMQService
import org.openiam.idm.provisioning.diff.model.user.ProvisionUserObjectDiff
import org.openiam.idm.searchbeans.PolicySearchBean
import org.openiam.idm.srvc.pswd.service.PasswordGenerator
import org.springframework.beans.factory.annotation.Autowired

/**
 * Script generates random password using password policy
 */
class UserPassword extends AbstractIPolicyMapGroovy<ProvisionUserObjectDiff> {

    private static final String DEFAULT_POLICY_ID = "4000"


    @Autowired
    private PolicyRabbitMQService policyRabbitMQService


    @Override
    boolean isPerform(ProvisionUserObjectDiff diffObject) {
        return AttributeOperationEnum.ADD.equals(diffObject.getStatus())
    }


    @Override
    void perform(ConnectorAttribute attribute, ProvisionUserObjectDiff diffObject) {
        PolicySearchBean psb = new PolicySearchBean()
        psb.addKey(DEFAULT_POLICY_ID)
        PolicyListResponse response = policyRabbitMQService.findBeans(psb, 0, 1)
        String password = PasswordGenerator.generatePassword(response.getList().get(0))
        attribute.addValue(new StringOperationalConnectorValue(password, diffObject.getStatus()))
    }
}