Password policy: set password requirements for local accounts

The Password policy page sets the rules for passwords that SSOGEN itself holds: people created in SSOGEN, imported from a file, or given an SSOGEN password. People who sign in through a directory (LDAP or Active Directory) or an external identity provider keep that system’s own password rules, and the page says so.

Open it: in the Admin Console choose Identity, then Password policy. A Super admin can read and change it. A role that can read security settings but not change them can open the page and not save.

Choose a preset

Under Start from a preset, choosing one fills in every field. One choice is enough for most organizations.

Preset	Minimum length	Mixed characters	Passwords remembered	Expiry	Lockout
Recommended (NIST SP 800-63B), the default	12	Not required	The current password may not be reused	Never	5 wrong passwords lock the account for 15 minutes
Stricter	15	Three of four kinds	Last 5	Every 90 days	5 wrong passwords lock for 30 minutes
Relaxed	8	Not required	None	Never	10 wrong passwords lock for 5 minutes

Choose Stricter when an audit asks for mixed characters, history and regular change. Choose Relaxed only for low-risk use together with a second factor. If you edit any field after choosing a preset, the page shows “Custom: the values below match no preset.”

The rules

Setting	What it does	Range
Minimum length	The fewest characters. An emoji or an accented letter counts as one.	8 to 64
Require mixed characters	Asks for at least three of: lowercase letters, uppercase letters, digits, symbols.	On or off
Passwords remembered	A new password may not repeat any of these, the current one included.	0 to 12 (0 allows reuse)
Password expiry (days)	After this many days the person must choose a new password at their next sign-in.	0 (never) to 730
Failed attempts before lockout	How many wrong passwords in a row lock the account.	3 to 100
Lockout duration (minutes)	How long the lock lasts.	1 to 1440

Select Save password policy. The page says “Password policy saved. It applies to the next password set and the next sign-in.” A value outside its range is named beside its field and nothing is saved.

Always on

These checks are part of SSOGEN and are not settings, whatever the policy says:

A password made of one repeated character or a short repeated pattern, or a run such as abcdefgh or 12345678, is refused.
A password that contains the person’s username (or the part of an email-style username before the @) is refused when that name is at least four characters long.
A password longer than 256 characters is refused.

Where it applies

The policy is checked every time SSOGEN sets a password: first-run setup, an administrator setting a password for a person, the forgot-password link, the forced change at sign-in, My Account > Password, and the break-glass recovery command. A refused password gets a message beside the field that says what to change, for example “Use at least 15 characters.” or “Choose a password different from the current one.” A refused password does not use up a reset link.

What to know before you change it

A stricter policy does not make anyone change their password at once. It applies the next time a password is set, or at sign-in once an expiry is reached.
A password an administrator sets for somebody is not compared with their older passwords, but it is remembered.
Passwords brought in as hashes in a user import are not checked, because there is nothing to read. The person meets the policy at their next change.
The change is recorded in the audit log as password_policy.changed, with the preset and the names of the settings that changed, never the values.