Password
You can select the following settings for passwords in Neptune DXP - Open Edition:
-
Minimum Password Length
-
Minimum Number of Uppercase Characters
-
Minimum Number of Special Characters
-
Minimum Number of Numbers
-
Minimum Number of Lowercase Characters
-
Password Validity Period (Days - If set to 0 passwords will never expire)
If you set the password validity period to 0, the password does not expire. -
Size of Password History
-
Password must not contain the username or email address
If selected, passwords that contain the username or the email address of the user are rejected.
-
Custom Validation Script
A server script that runs additional custom password checks. See Custom validation script.
Custom validation script
In Custom Validation Script, you can select a server script that runs after the built-in password rules whenever a password is set or changed: when a user is created, when an administrator sets a password, when a user changes their own password, and when a password is reset through the forgot-password flow.
The script receives the following globals:
-
password: the new password in plain text -
user:id,username,email,name, androles(each role hasid,name, andisGlobalAdmin) -
result: an object with anerrorsarray
Push a message to result.errors to reject the password. The messages are
shown to the user. Leave the array empty to accept the password.
const isAdmin = user.roles.some((role) => role.isGlobalAdmin);
if (isAdmin && password.length < 20) {
result.errors.push("Minimum 20 characters");
}| If the script throws an error or cannot be found, the password is rejected. |
Test the script before you select it in a production system.
Password Lock
To prevent brute-force log-in attacks, select the following autolock settings:
-
Number of Tries before Autolock
If you set the number of tries before autolock to 0, no autolock is applied. A user can enter an incorrect password an unlimited number of times without login autolocking. -
Remove Autolock After No. Minutes
-
Waiting Time Before Removing Autolock (Minutes)
The default waiting time before removing the autolock is 30 minutes.
-
Message when user tries to access a locked account
The following messages can be selected:
-
Neutral - "Wrong username/password combination"
-
Specific - "Locked account"
-
-
Send a notification email to the user when their account is locked due to too many login attempts
The checkbox is selected by default.
Password setting interplay
If the number of login attempts exceeds the number set in Number of Tries before Autolock, the message set in Message when user tries to access a locked account is displayed to the user. If you select Send a notification email to the user when their account is locked due to too many login attempts, a notification email is sent to the email address of the user that is set in the User tool.