Password Settings

Password settings are part of an identity policy. They define how the Delinea Platform validates passwords, when passwords expire, and when repeated failed logins lock an account. The settings apply to the users that the identity policy matches.

The Delinea Platform manages passwords for Delinea Platform Directory (local) users. Users from external directories, such as Active Directory, change their passwords in that directory.

Accessing Password Settings

Navigate to Access > Identity Policies.
Select the identity policy that applies to the users.
Select User Security > Password Settings.
Configure the settings described in the following sections.
Click Save.

The Identity policy summary tab on a user's page does not display the Password Requirements values. To view the requirements that apply to a user, open the user's identity policy. See Identity Policy Summary Tab.

Password Requirements

The Password Requirements settings validate passwords that users enter manually. Each setting defines a minimum that a password must meet, not a maximum.

The random password generator reads only the Minimum password length and Maximum password length settings from the effective policy. The generator ignores the other requirements. Generated passwords always include uppercase letters, lowercase letters, digits, and symbols, excluding ambiguous characters. This character set is fixed and cannot be configured.

A generated password can include symbols even when Require at least one symbol is set to No. That setting defines a validation requirement; it does not exclude symbols.

The Generated option when creating a service user produces an alphanumeric password without symbols. See Service Users.

Available Settings	Description
Minimum password length (default 8)	Use the drop-down list to select the minimum length required for a password or "--" to use the default setting, which is 8. The Delinea Platform enforces a minimum length of 8 characters.
Maximum password length (default 64)	Use the drop-down list to select the maximum length required for a password or "--" to use the default setting, which is 64.
Require at least one digit (default yes)	Select Yes to require at least one digit in the password, No if a digit is not required, or "--" to use the default setting, which is Yes. Selecting No does not prevent digits from appearing.
Require at least one upper case and one lower case letter (default yes)	Select Yes to require at least one upper case and one lower case letter (total two letters) in the password, No if mixed case is not required, or "--" to use the default setting, which is Yes. Selecting No does not prevent letters from appearing.
Require at least one symbol (default no)	Select Yes to require at least one symbol, No if a symbol is not required, or "--" to use the default setting. The default is No. Selecting No does not prevent symbols from appearing.

Display Requirements

Available Settings	Description
Show password complexity requirements when entering a new password (default no)	Enabling this policy displays the password complexity requirements when updating a user account password. The default value "--" is equivalent to No.
Password complexity requirements for directory services other than Delinea Directory	Password complexity requirements for Delinea Directory users are automatically discovered but all other directory services require manually entering a complexity requirement string.

Additional Password Setting Requirements

Available Settings	Description
Limit the number of consecutive repeated characters	Password cannot contain consecutive repeated characters equal to or more than the set value. The default is to allow consecutive repeated characters.
Check against weak password	Select Yes to check password-strength, No to save password without password-strength checking, or "--" to use the default setting, which is No.
Allow username as part of password	Select Yes to allow username in the password, No to disallow username in the password, or "--" to use the default setting, which is Yes.
Allow display name as part of password	Select Yes to allow part of displayname in the password, No to disallow part of displayname in the password, or "--" to use the default setting, which is Yes.

Password Age

Available Settings	Description
Minimum password age before change is allowed (default 0 days)	The default is 0 days. Users will not be allowed to change or reset their password until the current password is at least this old.
Maximum password age (default 365 days)	The default is 365 days. After the password expires, users are prompted to enter their current password and then enter a new one. Enter 0 (zero) if you do not want to specify a password expiration period.
Password history (default 3)	Use the drop-down list to select the number of most recent passwords to save or "--" to use the default setting. The user cannot re-use the passwords on this list. The number you enter is displayed in the message when the user is prompted to enter a new password.
Password Expiration Notification (default 14 days)	Select the number of days before a user's password expires to begin posting a notification of expiration through a portal banner. This policy applies to Delinea Directory (local Platform) users.
Escalated Password Expiration Notification (default 48 hours)	Select the number of hours before a user's password expires to present a change password dialog. The dialog is automatically displayed when the user logs in. This policy applies to Delinea Directory (local Platform) users. Note: This policy is not supported on mobile clients.
Enable password expiration notifications on enrolled mobile devices	When enabled, password expiration notifications are sent to registered mobile devices. The default setting "--" is equivalent to Yes.

Capture Settings

Capture settings control account lockout after repeated failed login attempts.

Available Settings	Description
Maximum consecutive bad login attempts allowed within window (default Off)	Use the drop-down list to select the number of failed password attempts allowed within the period you specify in the "Capture window for consecutive bad password attempts" policy before the user is locked out, Off to allow the user an unlimited number of failed attempts, or "--" to use the default setting. Users are locked out for the time period you specify in the "Lockout duration before password re-attempt allowed" policy when they fail in the attempt after the number you select.
Capture window for consecutive bad login attempts (default 30 minutes)	Enter the number of minutes to define the time period before the number of failed password attempts is reset. This time period is only applicable when the "Maximum consecutive bad password attempts allowed within window" policy defines the number of failed attempts allowed and is not set to Off. The user is locked out for the time period you set in the "Lockout duration before password re-attempt allowed" policy. After that, the user can attempt to log in again.
Lockout duration before login re-attempt allowed (default 30 minutes)	Enter the number of minutes users must wait before they can attempt to log in again after lockout.
Limit number of login attempts	Account locks after exceeding this number of failed login attempts.

Troubleshooting

Issue: A generated password does not match the complexity settings

Cause: The generator reads only the minimum and maximum length from the effective policy. The complexity settings validate passwords that users enter manually.

Solution:

If the integration or user requires a specific character set, enter the password manually.
Verify that the manually entered password meets the Password Requirements in the effective policy.

Issue: The Identity policy summary tab does not show password requirements

Cause: The tab does not display Password Requirements values.