Versions Compared

Old Version 10

changes.mady.by.user Eleanor Brodie

Saved on

compared with

New Version 11

changes.mady.by.user Fiona Sargeant (Unlicensed)

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

This page is for PhixFlow administrators to set up rules about user passwords. 

Insert excerpt
_admin_user_topic
_admin_user_topic
nopaneltrue

Overview

PhixFlow applies a single password policy to all user accounts. When it is first installed, PhixFlow is configured to use the Default password policy, which only requires a password to have at least 6 characters. 

If you are using PhixFlow's accounts to manage user access, users must log in to PhixFlow using the password set in their user properties; see User. Administrators can use the password policies property tab to set rules and restrictions for user passwords. You can either change the details of the Default policy or create a different policy. You can set rules for:

  • the length of characters and the characters they must contain
  • whether passwords can be reused after a time period or an intervening number of different passwords
  • how long passwords can be used before they expire
  • how many login attempts can be made before the account is locked
  • resetting passwords.


Panel
borderColor#7da054
titleColorwhite
titleBGColor#7da054
borderStylesolid
titleSections on this page

Table of Contents
stylenone



Note

If you create a different password policy, remember to update the System Configuration → Advanced → Password Policy to use it.

If you do not want to use PhixFlow's accounts to manage user access, but instead want to integrate PhixFlow with a single sign-on system, see:

See also pages in the  PhixFlow User Administration topic.

Insert excerpt
_standard_settings
_standard_settings
nopaneltrue

Using a Different Password Policy

To use a different password policy:

  1. In the repository browser, scroll to System Configuration and click to open its property tab; see  System Configuration.
  2. Expand the Advanced section.
  3. In the Password Policy field, select the policy you require from the drop-down list.

Adding or Changing a Password Policy

To create or change a password policy, in the repository browser scroll down to the 

Insert excerpt
_password_policies_repo
_password_policies_repo
nopaneltrue
  section. Members of a user group have access to the modelling objects and applications listed in the property tab. The user group inherits privileges from the roles listed in the property tab. 

Basic Settings

Note

Except for Minimum Length, an empty field means that PhixFlow does not apply a restriction.


FieldDescription
NameName of the password policy
Passwords must have at least:
Minimum Length

The minimum number of characters in password. If this field is left empty, the minimum length is 1.

Upper Case CharsThe minimum number of upper case characters [A-Z] in the password.
Lower Case CharsThe minimum number of lower case characters [a-z] in the password.
Numeric CharsThe minimum number of digits [0-9] in the password.
Special Chars

The minimum number of special characters in the password. Allowed special characters are:

 \ ! " # $ % & ( ) * + , . / : ; < = > ? @ [ ] ^ _ { | } ~

A new password cannot be the same as:
A password used in the last N daysA new password cannot be the same as a password used previously within this number of days.
Any of the last N passwordsA new password cannot be the same as any of this number of previous passwords.
Passwords will expireexpires after:
After a warning period of N

Days Valid


The

Enter the number of days for which the password is valid. For example, to configure a password that is valid for

before the

6 months, enter 180. At the end of this number of days, the password expires.

The user is not warned

to change

that their password

(if a grace period is configured) or the password expires (if no grace period is configured).		... and a Grace Period of N DaysIf a grace period is configured users will be warned during login that their password is about to expire. The warning will be displayed after the password validity period configured above, for the number of days of the grace period. At the end of the grace period the password will expire

is due to expire. To provide the user with a warning and a period of time in which to change their password, set Days to Reset.

Days to Reset

Enter the number of days that the password continues to be valid, during which PhixFlow notifies the user that their password is due to expire. For example, to add an extra 2 weeks in which the user can continue to use their password, enter 14.

The Days to Reset starts when the Days Valid is exceeded. When the user logs in, PhixFlow displays a message telling them the number of days that remain before their password expires.

If the user changes their password during the Days to Reset period, the number of Days Valid starts again.

If the user does not change their password, when the Days to Reset is exceeded, the password expires.

Lock account after:
Failed login attemptsThe user's account will be locked after this number of unsuccessful login attempts.
Password reset:
Allow Reset

Insert excerpt
_check_box_ticked
_check_box_ticked
nopaneltrue
 means a user can request a password-reset link to be emailed to their configured email address.

When the user follows this link, they must answer a security question and then provide a new password. 

Tip

Users configure their security questions in their user properties; see User.

To set the From address that PhixFlow uses for password reset emails, go to System Configuration → System Email Address.


Maximum reset attempts

The maximum number of attempts the user can make to reset their password. After this number of failed attempts, the user must contact their system administrator.

Reset links valid for

The link in a reset email is valid for this number of minutes. A link older than this will be rejected.

If no value is set, reset links are valid indefinitely.