Password Settings
Password settings are part of an identity policy. They define how the Delinea Platform validates passwords and when passwords expire. The settings apply to the users that the identity policy matches. The Platform also locks accounts after repeated failed logins; see Account Lockout.
The Delinea Platform manages passwords for Delinea Platform Directory (local) users. Users from external directories, such as Active Directory, change their passwords in that directory.
These settings are unrelated to Secret Server password requirements, which govern passwords stored in secrets. See Secret Server and Platform Password Requirements.
Accessing Password Settings
- Navigate to Access > Identity Policies.
- Select the identity policy that applies to the users.
- Select User Security > Password Settings.
- Configure the settings described in the following sections.
- Click Save.
The Identity policy summary tab on a user's page does not display the Password Requirements values. To view the requirements that apply to a user, open the user's identity policy. See Identity Policy Summary Tab.
Password Requirements
The Password Requirements settings validate passwords that users enter manually. Each setting defines a minimum that a password must meet, not a maximum.
The random password generator reads only the Minimum password length and Maximum password length settings from the effective policy. The generator ignores the other requirements. Generated passwords always include uppercase letters, lowercase letters, digits, and symbols, excluding ambiguous characters. This character set is fixed and cannot be configured.
The generator targets a length of 40 characters and then applies the policy limits. If the maximum password length is lower than 40, the generated password is the maximum length. If the minimum password length is higher than 40, it is the minimum length. With the default settings of 8 and 64, generated passwords are 40 characters long.
A generated password can include symbols even when Require at least one symbol is set to No. That setting defines a validation requirement; it does not exclude symbols.
The Generated option when creating a service user produces an alphanumeric password without symbols. See Service Users.
| Available Settings | Description |
|---|---|
| Minimum password length (default 8) | Use the drop-down list to select the minimum length required for a password or "--" to use the default setting, which is 8. The Delinea Platform enforces a minimum length of 8 characters. |
| Maximum password length (default 64) | Use the drop-down list to select the maximum length required for a password or "--" to use the default setting, which is 64. |
| Require at least one digit (default yes) | Select Yes to require at least one digit in the password, No if a digit is not required, or "--" to use the default setting, which is Yes. Selecting No does not prevent digits from appearing. |
| Require at least one upper case and one lower case letter (default yes) | Select Yes to require at least one upper case and one lower case letter (total two letters) in the password, No if mixed case is not required, or "--" to use the default setting, which is Yes. Selecting No does not prevent letters from appearing. |
| Require at least one symbol (default no) | Select Yes to require at least one symbol, No if a symbol is not required, or "--" to use the default setting. The default is No. Selecting No does not prevent symbols from appearing. |
Display Requirements
| Available Settings | Description |
|---|---|
| Show password complexity requirements when entering a new password (default no) | Enabling this policy displays the password complexity requirements when updating a user account password. The default value "--" is equivalent to No. |
| Password complexity requirements for directory services other than Delinea directory | Password complexity requirements for Delinea Directory users are automatically discovered but all other directory services require manually entering a complexity requirement string. |
Additional Settings
| Available Settings | Description |
|---|---|
| Check for weak password | Select Yes to check password-strength, No to save password without password-strength checking, or "--" to use the default setting, which is No. |
| Allow username as part of password | Select Yes to allow username in the password, No to disallow username in the password, or "--" to use the default setting, which is Yes. |
| Allow display name as part of password | Select Yes to allow part of displayname in the password, No to disallow part of displayname in the password, or "--" to use the default setting, which is Yes. |
| Limit the number of consecutive repeated characters | Password cannot contain consecutive repeated characters equal to or more than the set value. The default is to allow consecutive repeated characters. |
Password Age
| Available Settings | Description |
|---|---|
| Minimum password age before change is allowed (default 0 days) | The default is 0 days. Users will not be allowed to change or reset their password until the current password is at least this old. |
| Maximum password age (default 365 days) | The default is 365 days. After the password expires, users are prompted to enter their current password and then enter a new one. Enter 0 (zero) if you do not want to specify a password expiration period. |
| Password history (default 3) | Use the drop-down list to select the number of most recent passwords to save or "--" to use the default setting. The user cannot re-use the passwords on this list. The number you enter is displayed in the message when the user is prompted to enter a new password. |
| Password expiration notification lead time (default 14 days) | Select the number of days before a user's password expires to begin posting a notification of expiration through a portal banner. This policy applies to Delinea Directory (local Platform) users. |
| Escalated password expiration notification lead time (default 48 hours) | Select the number of hours before a user's password expires to present a change password dialog. The dialog is automatically displayed when the user logs in. This policy applies to Delinea Directory (local Platform) users. Note: This policy is not supported on mobile clients. |
| Enable password expiration notifications on registered mobile devices | When enabled, password expiration notifications are sent to registered mobile devices. The default setting "--" is equivalent to Yes. |
Account Lockout
The Delinea Platform locks an account after repeated failed login attempts. By default, five failed attempts within a 30-minute window lock the account for 30 minutes. These values are not configurable in the identity policy. The Password settings sub-tab does not display them.
Lockout applies differently by user type:
-
Delinea Platform Directory (local) users: the Platform enforces the lockout.
-
Active Directory users: Active Directory enforces its own lockout policy. By default, the Platform also applies its lockout on top.
-
Federated users, including Entra ID: the Platform does not apply a password lockout. The identity provider owns lockout for these users.
To see whether an account is locked, open the user's page and check Account is locked under Advanced Settings. See Advanced Settings.
Troubleshooting
Issue: A generated password does not match the complexity settings
Cause: The generator reads only the minimum and maximum length from the effective policy. The complexity settings validate passwords that users enter manually.
Solution:
- If the integration or user requires a specific character set, enter the password manually.
- Verify that the manually entered password meets the Password Requirements in the effective policy.
Issue: A user is locked out after failed login attempts
Cause: The user exceeded five failed login attempts within 30 minutes.
Solution:
- Wait 30 minutes, then try again.
- If the user cannot wait, an administrator can clear Account is locked on the user's page under Advanced Settings.
- For Active Directory users, also check the lockout status in Active Directory.
Issue: The Identity policy summary tab does not show password requirements
Cause: The tab does not display Password Requirements values.
Solution:
- On the user's Identity policy summary tab, note the policy that supplies the User security settings.
- Navigate to Access > Identity Policies and open that policy.
- Select User Security > Password Settings to view the requirements.
