Sun Java(TM) System Directory Server Online Help |
Password Tab of the Password Policy Dialog
Use the fields on this screen to define your password policy.
User Password Change
The following options define when and how often users may modify their password.
User must change password after reset. When selected, users must change their passwords when they first log in or after the administrator resets the passwords.
User may change password. When selected, allows users to change their own password attribute.
Allow changes in X day(s). Defines the minimum number of days between changes to a password, when not unlimited. Set this value in conjunction with "Keep password history" to discourage users from recycling old passwords.
No limitation. Select this checkbox to have no limitation on the frequency of password changes. Deselect this checkbox to set a value in the field.
Keep password history. Select this checkbox to prevent users from reusing old passwords. When selected, also enter the number of passwords the server will remember. The user will be prevented from reusing any remembered password. Use this option in conjunction with "Allow changes in X day(s)" to discourage users from reusing old passwords.
Remember X passwords. If the server is keeping a password history, this option specifies how many old passwords the server should store in the history list. The valid value range is from 1 to 24, inclusive.
Password Expiration
Password never expires. Select this option if you do not require users to change their passwords periodically.
Password expires after X days. Select this option if you want to force users to change their passwords periodically, and enter the length of password validity in the text box. The valid value range is from 1 to 24,855 days.
When a password expires, the user cannot bind to the directory and the administrator must reset the password.
Send warning X day(s) before password expires. Indicates the number of days before a user's password is due to expire that the user will be notified. The valid value range is from 1 to 24,855 days, and you must enter a value less than the expiration delay in the previous field.
Notifications about a password that is expiring or that has expired are sent as controls in the response to the user's bind request. Client behavior will determine whether or not a message is displayed to the user.
Expire regardless of warning. This checkbox determines the effect of a password warning. When this checkbox is selected, passwords will expire exactly at the time determined by the expiration policy. If a user binds within the warning period, the server will indicate the length of time remaining before expiration.
When this checkbox is deselected, the password expiration date will be extended when a user binds within the warning period. The server will automatically modify the expiration date to allow the user a full warning period before expiration. For example, if the warning period is seven days, the first time that a user binds within the warning period, the definitive expiration will be set to 7 days from the bind time. No further warnings will be sent and the password expiration will not be extended again.
In all cases, the user will not be able to bind after the password expires, even if no warning was sent because the user did not bind within the warning period.
Password Syntax
Check password syntax. Select this checkbox to enforce password syntax checking. Syntax checking ensures that any new password has at least the minimum password length and prevents passwords that appear in the uid, cn, sn, givenName, ou, or mail attributes of the user's entry.
Password minimum length. This field specifies the minimum number of characters that must be used in directory user passwords. The valid value range is from 2 to 512 characters.
Allow Directory Manager to bypass Password Policy. Select this checkbox to allow the Directory Manger to set a password to any value, regardless of the syntax check or password history settings. When not selected, the password history and syntax checking will be enforced as configured, even for operations performed by the Directory Manager.
Password encryption. Specify one of the following encryption formats for encrypting passwords stored in the directory:
No encryption (CLEAR) - This encryption type indicates that the password will appear in plain text.
UNIX crypt algorithm (CRYPT) - Provided for compatibility with UNIX passwords.
Secure Hashing Algorithm (SHA) - A one-way hash algorithm that was the default encryption schema in Directory Server 4.x.
Salted Secure Hashing Algorithm (SSHA) - This method is recommended as the most secure. SSHA is the default encryption method.
Note that passwords used for secure login through SASL Digest MD5 must use the CLEAR format.
See Also
Chapter 7, "User Account Management," in the Sun Java System Directory Server Administration Guide.