Verify Privilege Vault and Platform Password Requirements

Verify Privilege Vault and the Verify Privileged Identity Platform both use the phrase password requirements, but for unrelated mechanisms. Verify Privilege Vault password requirements govern the passwords stored in secrets. Platform password settings govern the passwords that users enter to log in to the Platform. This topic explains the difference for administrators who manage both products.

How the Two Mechanisms Differ

  Verify Privileged Identity Platform password settings Verify Privilege Vault password requirements
Where you configure them In an identity policy: Access > Identity Policies > [policy] > User Security > Password Settings. As a stored password requirement object: Administration > Secret Templates > Password Requirements. You assign a requirement to the password field of a secret template.
What they govern Platform login passwords for the users that the identity policy matches. Passwords stored in secrets that use the template, whether entered manually or generated.
Effect on generated passwords Length only. The generator targets 40 characters, within the minimum and maximum length from the effective policy, and ignores the complexity settings. Full. Generated passwords conform to the requirement's length, character set, and rules.
Effect on manually entered passwords The complexity settings validate the password. Each setting is a minimum the password must meet. The requirement validates the password when validation is enabled on the secret template.
Character set Fixed. Generated passwords always include uppercase letters, lowercase letters, digits, and symbols. You cannot change the set. Configurable. You select a character set for each requirement and can define custom sets.

In short: Verify Privilege Vault password requirements drive both validation and generation, including the character set. Platform password settings drive only the length of generated passwords; the complexity settings validate passwords that users type.

Service Users

Creating a service user on the Platform is the one action that touches both mechanisms. When you create a Platform service user, the Platform also creates a corresponding Application Account in Verify Privilege Vault with no additional action from you.

On the Platform side, the Generated option for a service user produces a 40-character alphanumeric password with no symbols. This password is not shaped by the identity policy's complexity settings. If an integration requires a specific character set, enter the password manually. See Service Users.

The Application Account that the Platform creates in Verify Privilege Vault does not have a usable password unless you set one manually in Verify Privilege Vault. The Platform service user's password follows the Platform rules for service users described above. Verify Privilege Vault password requirements do not apply to it, because they govern passwords stored in secrets, not account passwords.

Migrated Users

Passwords are not synchronized between the Platform and Verify Privilege Vault. A user who logs in to both products directly maintains a separate password in each. See Managing User Accounts.

Related Topics