Secret Server and Platform Password Requirements

Secret Server and the Delinea Platform both use the phrase password requirements, but for unrelated mechanisms. Secret Server password requirements govern the passwords stored in secrets. Platform password settings govern the passwords that users enter to log in to the Platform. This topic explains the difference for administrators who manage both products.

How the Two Mechanisms Differ

  Delinea Platform password settings Secret Server password requirements
Where you configure them In an identity policy: Access > Identity Policies > [policy] > User Security > Password Settings. As a stored password requirement object: Administration > Secret Templates > Password Requirements. You assign a requirement to the password field of a secret template.
What they govern Platform login passwords for the users that the identity policy matches. Passwords stored in secrets that use the template, whether entered manually or generated.
Effect on generated passwords Length only. The generator targets 40 characters, within the minimum and maximum length from the effective policy, and ignores the complexity settings. Full. Generated passwords conform to the requirement's length, character set, and rules.
Effect on manually entered passwords The complexity settings validate the password. Each setting is a minimum the password must meet. The requirement validates the password when validation is enabled on the secret template.
Character set Fixed. Generated passwords always include uppercase letters, lowercase letters, digits, and symbols. You cannot change the set. Configurable. You select a character set for each requirement and can define custom sets.

In short: Secret Server password requirements drive both validation and generation, including the character set. Platform password settings drive only the length of generated passwords; the complexity settings validate passwords that users type.

Service Users

Creating a service user on the Platform is the one action that touches both mechanisms. When you create a Platform service user, the Platform also creates a corresponding Application Account in Secret Server with no additional action from you.

On the Platform side, the Generated option for a service user produces a 40-character alphanumeric password with no symbols. This password is not shaped by the identity policy's complexity settings. If an integration requires a specific character set, enter the password manually. See Service Users.

The Application Account that the Platform creates in Secret Server does not have a usable password unless you set one manually in Secret Server. The Platform service user's password follows the Platform rules for service users described above. Secret Server password requirements do not apply to it, because they govern passwords stored in secrets, not account passwords.

Migrated Users

Passwords are not synchronized between the Platform and Secret Server. A user who logs in to both products directly maintains a separate password in each. See Managing User Accounts.

Related Topics