Password criteria and system parameters
Password quality criteria
The quality criteria for passwords can be set via the system parameters (Spring beans configuration). The following quality criteria exist (see class PoPasswordQuality):
- validityDays - the number of days after which the password must be changed.
- minimalLength - the total minimum length
- requiresUpperAndLowerCharacters - if true, both lowercase and uppercase characters must occur
- minimalDigitsCount - minimum number of digits "0-9"
- minimalSpecialCharactersCount - minimum number of special characters such as "@" or "!"
- numberOfDifferingLatestPasswords - minimum number of different passwords before one may be reused
- resetPasswordTokenValidityInHours - validity (in hours) of the link that the user receives by e-mail for setting a new password
For individual clients, the minimum length, uppercase and lowercase letters, the minimum number of digits and special characters, the number of different passwords and the validity of the reset link can be set differently in the client's password settings. A value set there takes precedence over the system parameter. There, two-factor authentication can also be enforced for all users of the client ("Enforce two-factor authentication").
If you want to deactivate password expiry in general, set validityDays to the value -1
System parameters relevant to password management:
| Module | Bean | Property | Explanation | Value(s) |
|---|---|---|---|---|
| po | PoPasswordQuality | minimalDigitsCount | required number of digits in the new password | Enter a number (e.g. 4; default: 0) |
| po | PoPasswordQuality | minimalLength | the minimum length (characters) of the new password | Enter a number (e.g. 6; default: 0) |
| po | PoPasswordQuality | minimalSpecialCharactersCount | required number of special characters such as "@" or "!" in the new password | Enter a number (e.g. 2; default: 0) |
| po | PoPasswordQuality | numberOfDifferingLatestPasswords | minimum number of different passwords before a previous password may be reused | Enter a number (e.g. 3; default: 0) |
| po | PoPasswordQuality | requiresUpperAndLowerCharacters | if true, both lowercase and uppercase characters must occur in the new password | "true" or "false" (default: false) |
| po | PoPasswordQuality | validityDays | the number of days after which the password must be changed. After expiry, the user is asked at login to set a new password.If this number is -1, passwords must NEVER be changed. The value 0 is not intended (smallest sensible value: 1). | Enter the number of days (e.g. 30; default: 30) |
| po | PoPasswordQuality | resetPasswordTokenValidityInHours | Validity in hours of the link that the user receives by e-mail for setting a new password ("Forgot password?", initial setup of the password for new persons) | Enter a number (default: 24) |
| po | AuthenticationOptions | allowPasswordResetByUser | Selection of whether the "Forgot password?" link is offered on the login page. The user then receives a mail (PoPasswordResetMail) with a link through which they set a new password themselves. | "true" or "false" (default: true) |
| po | AuthenticationOptions | maxNumberOfFailedLoginAttempts | Number of failed login attempts within maxNumberOfSecondsBetweenFailedLoginAttempts seconds after which the user is locked; the user receives a mail about this (bean PoLockUserMail). Via "Forgot password?" the user can set a new password and is thereby unlocked again. 0 = no lockout. | Enter a number (e.g. 5; default: 0) |
| po | AuthenticationOptions | maxNumberOfSecondsBetweenFailedLoginAttempts | Period in seconds in which the failed login attempts are counted | Enter a number (default: 60) |
| po | AuthenticationOptions | allow2ndFactorPerUser | Selection of whether users can activate or deactivate two-factor authentication themselves in their security settings. If "Enforce two-factor authentication" is activated for the client, it applies to all users of the client. | "true" or "false" (default: false) |
| po | PoPasswordNewPersonCreated | explicitRecipient | Recipient of the mail for the initial setup of the password, if the e-mail stored for the person is not to be used | E-mail address (e.g. recipient@workflow.at) |
| po | PoPasswordNewPersonCreated | senderMailAddress | the mail address to be used as sender for the welcome mail | E-mail address (e.g. welcome@workflow.at; default: office@workflow.at) |
| po | PoPasswordNewPersonCreated | subject | Subject line of the e-mail for the initial setup of the password | Free text (e.g. "You need to setup your Webdesk password") |
| po | PoPasswordNewPersonCreated | templateBody | Mail text for new persons in Webdesk for the initial setup of the password. Can contain the variables $person.firstName and $person.lastName. The text must contain the link for setting the password with the variable $resetId (e.g. <Webdesk-URL>/changepassword?resetId=$resetId). | Free mail text (the default text does not yet contain a link and must be adapted) |
| po | PoPasswordResetMail | explicitRecipient | Recipient of the password change mail, if the e-mail stored for the person is not to be used | E-mail address (e.g. recipient@workflow.at) |
| po | PoPasswordResetMail | senderMailAddress | the mail address to be used as sender | E-mail address (e.g. password-service@workflow.at; default: office@workflow.at) |
| po | PoPasswordResetMail | subject | Subject line of the mail | Free text (e.g.: "Your Webdesk password has been reset") |
| po | PoPasswordResetMail | templateBody | Mail text; the mail contains no password, but a link through which the user sets a new password. The text must contain the link with the variable $resetId and can contain $person.xxx (person data). | Free mail text, e.g.:Dear $person.firstName $person.lastName, please click this link to set a new password: <Webdesk-URL>/changepassword?resetId=$resetId(the default text does not yet contain a link and must be adapted) |
| po | PoPasswordResetPolicy | forcePasswordChangeAfterReset | Selection of whether a password change is mandatory after the administrator has reset the password (true = yes) | "true" or "false" (default: true) |
| po | PoPasswordResetPolicy | forcePasswordChangeAfterResetToRandomPassword | Has no effect: When resetting via e-mail link ("Forgot password?"), a random password is no longer assigned; the user sets a new password themselves via the link. | "true" or "false" (default: false) |
| po | PoPasswordResetPolicy | standardResetPassword | Default password to which the password is reset if "useUsernameAsStandardPassword" is set to false | Free text, entry of a default password (e.g. "webdesk"; default: webdesk) |
| po | PoPasswordResetPolicy | useUsernameAsStandardPassword | Selection of whether the user name is to be used as the default password when the password is reset | "true" or "false" (default: true) |
In "Advanced functions" there are two new actions in the select box under "Module-specific actions":
- Reset all passwords
all passwords are reset to the value specified by the password reset policy - Reset all passwords to random values and send mails
despite the name, random passwords are no longer assigned: Each user receives a mail (PoPasswordResetMail) with a link through which they can set a new password (valid according to resetPasswordTokenValidityInHours); the previous password remains valid until then. A valid e-mail address for the person is required.
"Stay logged in" function
The "stay logged in" function is intended as an aid for those system installations where no single sign-on with the operating system is provided. So that the user does not have to re-enter their password every time, the option "stay logged in" can be selected when logging in, and the user is then automatically logged in the next time they access Webdesk from the same browser within a period of 14 days.
Neither the user name nor the password is stored in the browser; instead a login token stored in the Webdesk database is used. After each use it is replaced by a new one, and on logout it becomes invalid. How should the security risk be assessed? If someone has access to the user's computer and can log in with their Windows user, they can also open their Webdesk (analogous to the classic SSO scenario).
For this function to be used, the system parameter po->AuthenticationOptions->allowRememberMemust be set to true (default: true).