This page is for PhixFlow administrators to set up rules about user passwords. For related information, see the PhixFlow User Administration topic.

Overview

A password policy contains the rules about how secure a password must be and how often it should be changed. You can set rules for:

the length of characters and the characters they must contain
whether passwords can be reused after a time period or an intervening number of different passwords
how long passwords can be used before they expire
how many login attempts can be made before the account is locked
resetting passwords.

PhixFlow applies a password policy to:

all user accounts
the encrypted files that PhixFlow exports to the download folder; see Configuring the Download Area.

When it is first installed, PhixFlow has one password policy, called Default. This only requires a password to have at least 6 characters. Initially, PhixFlow is set to use the default password policy for both user and file export passwords; see Using a Different Password Policy, below.

Sections on this page

Before you create user accounts, it is a good idea to set up the password policy to have the rules your company requires. You can:

either update the default password policy
or to create one or more new password policies.

See Adding or Changing a Password Policy, below.

If you are using PhixFlow's accounts to manage user access, users must log in to PhixFlow using the password set in their user properties; see User.

If you do not want to use PhixFlow's accounts to manage user access, but instead want to integrate PhixFlow with a single sign-on system, see:

See also pages in the User Administration topic.

Adding or Changing a Password Policy

To create or change a password policy, in the repository scroll down to the Password Policies section. Double-click on an existing password policy to edit it. To create a new password policy, right-click Password Policies and click Add.

If you create a different password policy, remember to update the System Configuration → Advanced → Password Policy or Export Password Policy to use it.

Using a Different Password Policy

To use a different password policy:

In the repository, scroll to System Configuration and click to open it.
Expand the Advanced section.
Select the policy you require from the drop-down list in the options:
- Password Policy
- Export Password Policy

When you create a user account in PhixFlow, it automatically applies the password policies set in System Configuration at that time. If you subsequently update System Configuration to use a different password policy, existing user accounts are not updated. They will continue to use the previous password policy.

If you want some users to have a different password policy, you will need to update their User account properties:

Basic Settings → Password Policy
Export Password options.

Password Policy Properties

For information about the properties toolbar, and about the sections Parent Details, Analysis Models, Description and Audit Summary, see Common Properties. For a full list of all the PhixFlow property tabs and windows, see Property Tabs.

Basic Settings

Except for Minimum Length, an empty field means that PhixFlow does not apply a restriction.

Update to indicate which fields are used in export

Field	Description
Name	Name of the password policy
Passwords must have at least:
Minimum Length	The minimum number of characters in password. If this field is left empty, the minimum length is 1.
Upper Case Chars	The minimum number of upper case characters [A-Z] in the password.
Lower Case Chars	The minimum number of lower case characters [a-z] in the password.
Numeric Chars	The minimum number of digits [0-9] in the password.
Special Chars	The minimum number of special characters in the password. Allowed special characters are: `\ ! " # $ % & ( ) * + , . / : ; < = > ? @ [ ] ^ _ { \| } ~`
A new password cannot be the same as:
A password used in the last N days	A new password cannot be the same as a password used previously within this number of days.
Any of the last N passwords	A new password cannot be the same as any of this number of previous passwords.
Password expires after:
Days Valid	Enter the number of days for which the password is valid. For example, to configure a password that is valid for 6 months, enter `180`. At the end of this number of days, the password expires. The user is not warned that their password is due to expire. To provide the user with a warning and a period of time in which to change their password, set Days to Reset.
Days to Reset	Enter the number of days that the password continues to be valid, during which PhixFlow notifies the user that their password is due to expire. For example, to add an extra 2 weeks in which the user can continue to use their password, enter `14`. The Days to Reset starts when the Days Valid is exceeded. When the user logs in, PhixFlow displays a message telling them the number of days that remain before their password expires. If the user changes their password during the Days to Reset period, the number of Days Valid starts again. If the user does not change their password, when the Days to Reset is exceeded, the password expires.
Lock account after:
Failed login attempts	The user's account will be locked after this number of unsuccessful login attempts.
Password reset:
Allow Reset	Tick means a user can request a password-reset link to be emailed to their configured email address. When the user follows this link, they must answer a security question and then provide a new password. Users configure their security questions in their user properties; see User. To set the `From` address that PhixFlow uses for password reset emails, go to System Configuration → System Email Address.
Maximum reset attempts	The maximum number of attempts the user can make to reset their password. After this number of failed attempts, the user must contact their system administrator.
Reset links valid for	The link in a reset email is valid for this number of minutes. A link older than this will be rejected. If no value is set, reset links are valid indefinitely.