You are viewing an old version of this page. View the current version.
Compare with Current
View Page History
Version 1
Current »
EmpowerID provides password management services enabling help desk password reset, end-user self-service password change and reset, and multi-directory password synchronization for external systems. These policies control the login and password self-service reset options a person receives when using EmpowerID. When EmpowerID is installed, all users discovered are assigned to the Default Password Manager Policy. You can modify this policy to meet your organization's needs or create new policies and assign those to users as desired.
In this topic, we demonstrate setting up Password Manager Policies by creating a new policy. The principles and settings discussed can be applied when existing password manager policies.
To set up password policies
On the navbar, expand Password Management and click Password & Login Policies.
Click the Add New Policy button.
In the General tab of the Policy Details form that appears, enter a name and description for the policy in the Name, Display Name and Description fields.
Set any of the optional settings explained below and click Save when finished.
General Settings - Password Complexity Settings
In the Password Complexity section, you can use the default Windows complexity, or customize to a level of complexity that is right for your organization.
Or:
Enter the minimum number of characters for passwords in the Min Length field, and
enter the maximum number of characters for passwords in the Max Length field, and
optionally use any of the custom settings in the below table.
Setting | Description |
|---|
Min Digits | Specifies the minimum number of digits required within passwords |
Min Special Characters | Specifies the minimum number of special characters required within passwords |
Maximum Pairs of Repeating Characters | Specifies the maximum number of repeating characters allowed within passwords |
Restrict First X Characters Of Login | Specifies the number of characters from the beginning of the user name that are not allowed within passwords
(e.g. 3 forbids the use of the first three letters of the user name within passwords) |
Password Requires Mixed Case | Enforces the use of upper and lower case letters within passwords |
Require Leading Letter | Enforces the use of a letter as the first character within passwords |
Require Mainframe Compatibility | Enforces mainframe password format requirements (max 8 characters, no special characters) |
Regular Expression Validator | Uses a regular expression to constrict and validate the use of characters within passwords
(the RegEx is applied in addition to any other settings specified) |
Password Prevent Username Words | Forbids the use of the user name in any part of passwords |
Password Prevent Dictionary Words | Forbids the use of words contained in the selected dictionary within passwords
|
Dictionary Word Set | Allows you to select the dictionary of words that are forbidden within passwords* |
General Settings - Password Change Policy Settings
In the Password Change Policy section, you can control whether and how often users must change passwords. You can accept the default behavior, or customize it with the settings in the table below.
Setting | Description |
|---|
Password Prevent Change | prevents users from changing their passwords |
Password Allow Reuse After X Days | the number of days that must pass before users can reuse passwords from their password history |
Password Allow Reuse After X Changes | the number of password changes that must occur before users can reuse passwords from their password history |
Password Require Change Every X Days | the number of days after which users are required to change their password |
Min Age to Allow Change (X Days) | the number of days users must wait before they are allowed to change their password |
Notify X Days Before Expires | the number of days prior to password expiration to send email notifications to users
(users must have an email account registered in EmpowerID) |
ReNotify Every X Days | the number of days after which to send email reminders to users
(reminders end when the user changes the password or the expiration date passes) |
Password Expiration Notification | enable this workflow to allow EmpowerID to send these email alerts
(see steps to enable it in the drop-down section below) |
Authentication Settings - Login Policy Settings
On the Authentication Settings tab, you can accept the default settings for your Login Policy or customize them with the settings in the below table.
Setting | Description |
|---|
Min Login LoA if Local | Sets the minimum number of MFA points* required for users within your local network |
Min Login LoA if Remote | Sets the minimum number of MFA points* required for users outside of your local network |
Min Passwordless Login LoA if Local | Sets the minimum number of MFA points required for users using passwordless login from within your network |
Min Passwordless Login LoA if Remote | Sets the minimum number of MFA points required for users using passwordless login from outside your network |
Default Home Page | Sets the relative path to the page of the EmpowerID Web application that users see after they login
(that portion of the page's URL that begins with the # symbol)
e.g. https://<EmpowerIDServer>/UI/#N/ITShop/SelfService
|
Attempts Before Lockout | the number of times a user can log in incorrectly before being locked out
(within the specified period of time set in the Login Lockout Failure Window field) |
Login Lockout Failure Window | the number of minutes during which a user's failed attempts to log in may result in a lockout
(the number of failed attempts as specified in the Attempts Before Lockout field) |
Login Lockout Duration (Minutes) | the number of minutes during which a locked-out user cannot log in
(if the Attempts Before Lockout number is exceeded within the Login Lockout Failure Window) |
Allow Remembered Registered Device | Specifies whether to remember the devices that users register when using that MFA method |
Allow Remember Registered Device X Days | Sets the number of days to remember registered devices when Allow Remembered Registered Device X Days is seleted |
Authentication Settings - One-Time Password Lock-Out Policy Settings
You can customize your one-time password lock policy settings here.
Setting | Description |
|---|
One Time Password Attempts Before Lockout | Specifies the number of times a user can log in incorrectly before being locked out
(within the period of time set in the One Time Password Attempts Window field) |
One Time Password Attempts Window (Minutes) | Specifies the number of minutes during which a user's failed attempts to log in may result in a lockout
(the number of failed attempts as set in the One Time Password Attempts Before Lockout field) |
One Time Password Lockout Duration (Minutes) | Specifies the number of minutes during which a locked-out user cannot log in
(if the One Time Password Attempts Before Lockout number is exceeded within the One Time Password Attempts Window) |
Authentication Settings - LDAP Policy Settings
For those using the EmpowerID Virtual Directory server, you can specify settings here.
Setting | Description |
|---|
Allow LDAP Authentication | Allows users in the Virtual Directory to authenticate to EmpowerID |
Require 2nd Factor for LDAP | Requires Virtual Directory users to perform multi-factor authentication
(users must have an OATH token) |
Enable Login if no Token Assigned | Allows Virtual Directory users who have yet to receive an OATH token to log in |
Authentication Settings - RADIUS Policy Settings
For those using the EmpowerID RADIUS service, you can specify settings here.
Setting | Description |
|---|
Allow RADIUS Authentication | Allows RADIUS users to authenticate to EmpowerID |
Require 2nd Factor for RADIUS | Requires RADIUS users to perform multi-factor authentication
(users must have an OATH token) |
Enable RADIUS Login if no Token Assigned | Allow RADIUS users who have yet to receive an OATH token to log in |
Authentication Settings - Custom Login Handler
For those who have created a custom login handler, you can specify it here.
Setting | Description |
|---|
Login Handler Assembly | the custom assembly containing your login handler |
Login Handler Type | the type of the login handler |
Self-Service Password Reset Settings - Password Reset Recovery Settings
Settings | Description |
|---|
Enable Multifactor Reset During Recovery | Specifies whether users must go through MFA when resetting forgotten passwords. If enabled, you need to set the minimum number of LoA (level of assurance) points local and remote users must accumulate in order to reset their passwords. |
Enable Question Answer Reset During Recovery | Specifies whether users must answer their personal challenge questions when resetting forgotten passwords. If enabled, you need to configure Password Reset Enrollment Settings. |
Force Enrollment During Login | Specifies whether users must enroll for password self-service reset during their first login |
Self-Service Password Reset - Password Reset MultiFactor Settings
If you enable multifactor reset during recovery, use these settings.
Setting | Description |
|---|
Min Reset LoA if Local | Specifies the minimum number of LoA points users within your network must accumulate before they can reset forgotten passwords. |
Min Reset LoA if Remote | Specifies the minimum number of LoA points users outside of your network must accumulate before they can reset forgotten passwords. |
Self-Service Password Reset - Password Reset Enrollment Settings
If you enable question answer reset during recovery, use these settings.
Setting | Description |
|---|
Number of Custom Questions Asked for Enrollment | Specifies the number of Password Challenge questions that users must create and answer during enrollment to identify themselves for self-service reset |
Number of Selectable Questions Asked for Enrollment | Specifies the number of predefined questions that users must answer during enrollment to establish the pool of questions to use for self-service reset |
Number of Help Desk Questions Asked for Enrollment | Specifies the number of predefined Helpdesk questions that users must answer during enrollment that the Help Desk can use to verify the user for reset |
Expire Enrollment After (Days) | Specifies the number of days that an enrollment remains valid before users are forced to re-enroll for password self-service reset |
Number of Recovery Questions Asked for Password Reset | Specifies the number of password recovery questions to ask users who cannot remember their passwords
(questions supplied by the user when enrolling for password self-service reset) |
Number of Recovery Minimum Answers for Password Reset | Specifies the minimum number of password challenge questions users must answer correctly before they can set a password |
Enrollment Prevent Duplicate Answers | Restricts users from re-using the same answer in response to multiple challenge questions |
Enrollment Prevent Question Word in Answer | Restricts users from re-using any of the question words in their answer to the question |
Enrollment Expiration Enabled | Forces users to re-enroll for password self-service reset after the number of days specified in Expire Enrollment After (Days) |
Self-Service Password Reset Settings - Password Reset Lockout Settings
Use these settings for configuring lockout policy for password self-service reset.
Setting | Description |
|---|
Enable Reset Center Lockout Policy | Locks anonymous users out of the Password Reset Center in accordance with the settings applied to the fields of this section |
Allow X Attempts Before Lockout | Specifies the number of times users can incorrectly answer their password challenge questions before being locked out of the recovery center |
During an X Minute Window | Specifies the number of minutes in a sliding window during which the number of incorrect challenge question answers occur before lockout |
Lockout Duration | Specifies the number of minutes that locked-out users must wait before they can use the Recovery Center again |
Bypass Min Password Age | Allows users who forget their password to bypass the password age requirements specified in Min Age To Allow Change (X Days)
(only has effect if the Min Age To Allow Change (X Days) setting is set to a number other than 0) |
Bypass Password History | Allows users who forget their password to bypass the password history requirements specified in Password Allow Reuse After X Days
(only has effect if the Password Allow Reuse After X Days setting is set to a number other than 0) |
User Agreements
User Agreements are set on the View page for Password Manager Policies. To navigate to a Password Manager Policy's View page, search for that policy on the Password & Login Policies page (accessible at https://<YourEmpowerIDServer>/ui/#Common/Find/PasswordManagerPolicy) and click the Display Name link for it.
On the View page for the Password Manager Policy, expand the User Agreements accordion.
Click the Add New button and enter the following information:
Name — The name of the user agreement to store in the database.
Display Name — The friendly name of the user agreement to display in the grid.
Usage Agreement Text (HTML) — Text of the Usage Agreement. The text needs to be entered in HTML format.
Description —Description of the Usage Agreement.
Priority (Lower is Higher) — Sets the priority of the Usage Agreement if the policy has more than one. The agreement with the highest priority is shown first, and then the one with the next highest priority and so on.
Version — Version number.
Click Save when finished.
When a person to whom the policy applies logs in for the first time after the user agreement is in place, they must agree to the content of the user agreement before they can access the site.
Create Challenge Questions
Assign Challenge Questions
Help Desk Password Reset
Reset Passwords
Send One-Time Passwords