Configure your password policy to increase your network security by enforcing rules about how users create their passwords. Apply Self Service Password Reset password policy in one the following ways:
Apply only the Self Service Password Reset policy
Apply only the LDAP policy
Merge the Self Service Password Reset policy with the LDAP policy
When you merge the Self Service Password Reset policy with the LDAP policy, Self Service Password Reset reads both policies. If both policies conflict with each other, Self Service Password Reset chooses the most restrictive policy.
Self Service Password Reset checks the text that a user set as their password and does not allow if that is available in the predefined password dictionary word list. The word list is a ZIP file containing one or more plain text files with one word per line.
Self Service Password Reset allows storing the shared password history for all users, which provides more security. You can also configure profile specific password policy, which means setting password policies for different group of users who are part of different profiles. For more information about the profile-specific password policy, see Configuring a Profile for Password Policy
To configure a password policy you must configure two different sets of settings in Self Service Password Reset.
To configure a password policy:
Log in to Self Service Password Reset at https://dns-name/sspr as an administrator.
In the toolbar, click your name.
Click Configuration Editor > Settings > Policies > Password Settings.
Configure the following settings:
Select any one of the following:
Self Service Password Reset reads the LDAP password policies. If you select this option, Self Service Password Reset ignores some of the Self Service Password Reset password policy settings.
Self Service Password Reset reads the Self Service Password Reset policies. If you select this option, Self Service Password Reset ignores any policy settings of the LDAP directory.
Self Service Password Reset reads both policies. If any conflict between these policies, Self Service Password Reset chooses the most restrictive value of the policy.
Select this option if you want to enable a global shared password history for all users on Main Menu. If enabled, all users share a common password history. This helps prevent usage of common organizational words in passwords. The system stores passwords as a salted and encrypted hash in the local database.
Specify the maximum age of the shared history storage in seconds. The default value is four weeks (2419200 seconds).
Select the required option from the following list that controls the use of case-sensitive password:
Read from Directory
True (Case Sensitive)
False (Case Sensitive)
Select Save changes.
To increase the security of the passwords you must define a word list. A word list is a predefined password dictionary that Self Service Password Reset checks against the text that users set as their passwords. Self Service Password Reset does not allow a password if that text is available in the word list. The word list is a ZIP file containing one or more plain text files with one word per line.
To configure the word list:
Log in to Self Service Password Reset at https://dns-name/sspr as an administrator.
In the toolbar, click your name.
Click Configuration Editor > Settings > Word Lists.
Configure the following settings:
Specify a word list file URL for dictionary checking to prevent users from using commonly used words as passwords. Using word lists is an important part of password security. Word lists are used by intruders to guess common passwords. The default word list included contains commonly used English passwords.
The first time a startup occurs with a new word list setting, it will take some time to compile the word list into a database. See the status screen and logs for progress information. The word list file format is one or more text files containing a single word per line, enclosed in a ZIP file. The String !#comment: at the beginning of a line indicates a comment.
The value must be a valid URL, using the protocol file (local file system), http, or https.
Select this option if you want to use the word list as case-sensitive for all matches. Changing this value causes a word list re-compilation.
Specify the number of characters in a word that Self Service Password Reset checks against the configured word list.
For example, if the word to be checked is word list and this setting is set to 6, then the system checks these combinations wordli, ordlis, and rdlist against the configured dictionary. If any of these values match, then the entire value is a match to the word list. If you specify 0 (the number) or the password to check is smaller than the value specified here, then the system checks the entire password against the word list by not any smaller parts of the password.
Specify the URL for the seed list. The value must be a valid URL, using the protocol file (local file system), http, or https.
When passwords are randomly generated, the system can generate friendly random password suggestions to users. It does this by using a seed word or words, and then modifying that word randomly until it is sufficiently complex and meets the configured rules computed for the user.
Select Save changes.