Template Password Requirements

Overview

A password requirement is a stored Verify Privilege Vault object that defines the requirements on a password text-entry field to validate user-entered passwords or make auto-generated passwords conform to set specifications. You can have multiple password requirements, but only one can be set to the default.

A password requirement is made up of a minimum and maximum length, a set of characters, and optional rules such as "At least three upper-case characters" or "The first character must be lower-case". The default password requirement is 12 characters from the default character set with at least one upper-case, lower-case, numeric, and symbol character.

Creating a Custom Password Requirement

To create a new password requirement:

1. Navigate to Administration > Secret Templates, and select the Password Requirements tab.

2. Click the Create button. A popup appears.

3. Type the name of the new password requirement in the Name text box.

4. (Optional) Type a description of the new password requirement in the Description text box.

5. Click the Minimum Password Length spinner to select or type a minimum allowed password length.

6. Click the Character Set dropdown list to select a character set for the password. The out-of-the-box default is abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890!@#$%^&*().

7. If you want the password requirement to become the new default, click to select the Is Default check box.

8. Click to select the desired password no-no check boxes. The options are:

   • Prevent Username: Do not allow the username to be part of the password.
   • Prevent Spatial Pattern: Do not allow strings of characters based their order on the keyboard, such as qwerty or asdfg.
   • Prevent Sequential Pattern: Do not allow strings of characters based on their order in the character set, such as abcd or 5678. Note: As character sets are case sensitive, AbCd is allowed.
   • Prevent Dictionary Words: Do not allow everyday English words in the password.

9. Click the Save button. The popup closes and the page for the new requirement appears (containing the choices you just made for the details and generation sections):

10. Scroll down to the Password Validation section.

11. Click the Edit button. The section expands.

12. Most of the validation rules are ones you have already set with these two exceptions, which you can now set:

    • Prevent Dictionary Words: Do not allow everyday English words in the password.
    • Prevent Words from Dictionary …: Do not allow words that appear in the named dictionary. In our example, the dictionary is named "Test."

13. Go to the Starting and Ending Character Validation section.

14. Click the Edit button.

15. To require specific starting characters, click to select the Require Specific Starting Characters check box. Two hidden controls appear. This allows you to make rules such as "password must start with three symbols and end with two lowercase letters."

    "Start and end with" rules can decrease the password entropy (resistance to brute force attacks).

16. Type or click the spinner to set the number of required starting characters.

17. Click the characters from dropdown list to select the character set to draw the characters from.

18. Repeat the procedure for any desired ending characters.

19. Click the Save button. An edit button now appears for the Character Count Validation section.

20. To set character count validation rules:

    1. Click the Edit button for the Character Count Validation section. The section expands.

    2. Click the Add Rule button and select one of the following types:

       • Minimum Required Characters Rule: For the first rule type, type the number of characters and select what character set they must come from, for example, "Minimum 5 characters from Upper Case (A-Z)." Do not confuse this rule with the Minimum Required Character Count Rules dropdown list described below, which controls how many of your rules must be satisfied rather than how many characters are required.

       • Maximum Consecutive Characters Rule: For the second rule, type the number of characters and select what character set they must come from, for example, "Maximum 5 characters from Lower Case (a-z)."

       • Repeating Characters Rule: Sets a limit on how many times any single character can appear in a password. You can set it anywhere between one and the maximum length of the password requirement. For example, the rule "At most 1 of the same character" means that any character can only appear one time in a password: Bztyopz is invalid because there are two z characters, and Bztyopx is valid because no character appears more than once

       • Repeating Consecutive Characters Rule: Sets a limit on how many times any single character can appear in a sequence in a password. You can set it anywhere between one and the maximum length of the password requirement. For example, "At most consecutively 2 of the same character" means any character can only appear one time in a password: Bzty1fxeee is invalid because there are three e characters at the end of the password. Bzty11fxe is valid because no character appears more than twice. Finally, Bzetey1efxe is valid, even though there are three e characters, because they do not appear next to each other.

    3. Once you create more than one rule, the Minimum Required Character Count Rules dropdown list appears. This sets how many of your character count validation rules a password must satisfy — it does not set a character count. The list offers All, followed by the numbers 1 up to one less than the number of "minimum of X characters" rules you created. Newly created password requirements default to All. See Character Count Validation Field Reference for details on each rule type.

       Selecting a number lower than the number of rules you created means some rules are not enforced, and both generated and manually entered passwords can be weaker than the individual rules suggest — no error or warning appears. In addition, All automatically adjusts as you add or remove rules, but a specific number does not: if you select 2 and later add a fourth rule, passwords still only need to satisfy two of the four rules. Unless you have a specific reason to require fewer rules, leave this set to All.
       Only "minimum of X characters" rules count toward the numeric options. If you create two rules of other types (or one of each), the dropdown list still appears but offers only All. This is expected behavior.

    4. Create as many additional character count validation rules as you desire by clicking the Add Rule button and repeating the procedure.

    5. Click the Save button.

21. Review the Password Rule Strength section to see how strong your choices are and any recommendations for improvement. The two tests are:

    • Entropy Score: The difficulty of cracking the password in a brute-force attack.
    • Total Strength Score: An overall weighted measure of password strength for passwords generated by the password requirements. Any rule conflicts will appear in the recommendations section.

Character Count Validation Field Reference

The following table lists each control in the Character Count Validation section of a password requirement. Labels are quoted as they appear in the user interface.

Control	What it does	Default	Notes
Minimum required characters rule	Requires at least the specified number of characters from a chosen character set, for example, "Minimum 5 characters from Upper Case (A-Z)."	None — you set the count and character set when you add the rule.	Do not confuse this rule with Minimum required character count rules, which controls how many of your rules must be satisfied rather than how many characters are required.
Maximum consecutive characters rule	Limits how many consecutive characters may come from a chosen character set, for example, "Maximum 5 characters from Lower Case (a-z)."	None — you set the count and character set when you add the rule.
Repeating characters rule	Limits how many times any single character can appear in the password, anywhere from one up to the maximum password length.	None — you set the limit when you add the rule.
Repeating consecutive characters rule	Limits how many times any single character can appear in an unbroken sequence, anywhere from one up to the maximum password length.	None — you set the limit when you add the rule.
Minimum required character count rules	Sets how many of your character count validation rules a password must satisfy. This control does not set a character count.	All for newly created password requirements.	Appears once you create two or more rules of any type. The options are All, then the numbers 1 up to one less than the number of "minimum of X characters" rules — only those rules count toward the numeric options, so the list can offer All as its only choice. All adjusts automatically as you add or remove rules; a specific number does not, so passwords can silently become subject to fewer rules than intended.

Assigning Requirements to a Secret Template

To assign requirements to a secret template: 

1. Navigate to Administration > Secret Templates.

2. Select the template you wish to edit.

3. Navigate to the Fields tab.

4. Select the Password field.

5. Select Edit for the Template Field Details section.

6. For Password Requirement, select your desired requirement.