Password policy
The password policy sets the length, complexity, and age rules for every local user's password. It applies when the site Sign-in method is Local. Users who sign in through single sign-on (SSO) authenticate with the identity provider, so these rules do not apply to them. Refer to SSO and sign-in method.
Configuring the password policy
You need the System administration permission to set the policy.
- Select ADMIN in the side menu, then System Configuration.
- On the Security tab, open the Password Policy group.
- Change the settings in the following table, then save the tab.
Saving the tab restarts Profinity and interrupts active sessions.
| Setting | Default | Range | Description |
|---|---|---|---|
| Minimum password length | 8 | 1 to 256 | The minimum number of characters in a local user's password. |
| Require uppercase letter | Off | On or off | The password must contain at least one uppercase letter. |
| Require lowercase letter | Off | On or off | The password must contain at least one lowercase letter. |
| Require digit | Off | On or off | The password must contain at least one digit. |
| Require special character | Off | On or off | The password must contain at least one special character. |
| Maximum password age (days) | Empty (no expiry) | 1 to 3650 | When set, local users must change their password after this many days. |
The shipped policy accepts any password of eight characters or more, with no complexity rules and no expiry. A site that handles safety-critical equipment raises the minimum length and switches on the complexity rules. It also sets Maximum password age (days) to match its organisation's identity policy. The dialog for changing a password shows the minimum length as the user types.
Forced password change
A user with the Security administration permission can require another user to change their password at the next sign-in. There are two ways to do this:
- Enable Require password change on next login in the user's settings in Users & Groups.
- Select Reset Password on the user's User Actions tab.
Reset Password sets the same requirement and signs out the user's active sessions. It is the preferred way to recover a compromised account, because no temporary password has to be shared. Reset Password is not shown on an administrator's own account.
A user with this requirement sees a change password dialog after signing in.
They cannot use Profinity until they save a new password that meets the policy.
The default admin account has this requirement already set, so the first sign-in as admin always forces a password change.
The default admin credentials are listed in the Security guide.
Refer to Who can sign in, by installation type for which installations have that account.
Changing your own password
A local user can change their own password. The Change My Password pill is shown only when the site sign-in method is Local and the session is not a kiosk session.
- Select ADMIN in the side menu, then the Change My Password pill.
- Enter the current password.
- Enter and confirm a new password.
- Select Update Password.
Profinity enforces the site policy when it saves the new password.
