Username and Password Guidelines
When creating a new user, the system administrator will create the initial password. This password will be valid for 90 days, after which the user will be required to create a new password. Users will not be able to reuse the same password.
These are the default parameters:
- minimum password length: passwords must be at least 8 characters
- maximum password age: passwords will expire after 90 days
- password complexity requirements: passwords must contain both letters and non-letters
Password Parameters
Note: Setting a parameter's value to zero or leaving the field blank means that no constraint is applied. For example, setting Life of Password to 0 (zero) means that a user's password never expires.
Password parameters can be redefined by a system administrator, using the following fields:
- MAX_UNSUCCESS_NUM: The value in this field specifies the number of attempts a user may make to log on before they are locked out of the system. When the value in this field is exceeded, the user will need to contact the System Administrator to unlock their account.
- PASSWORD_LIFE: The number of days that a password can be active. Once expired, on the next user logon, the user will be required to change their password.
- PASSWORD_MIN: The minimum number of characters for a password and user name.
- PASSWORD_MIN_LOWERCASE_CHARS: The value in this field indicates the minimum number of lowercase characters that must be in a password.
- PASSWORD_MIN_NONALFANUM_CHARS: The value in this field indicates the minimum number of non-alphanumeric characters that must be in a password.
- PASSWORD_MIN_NUMERIC_CHARS: The value in this field indicates the minimum number of numeric characters that must be in a password.
- PASSWORD_MIN_UPPERCASE_CHARS: The value in this field indicates the minimum number of uppercase characters that must be in a password.
- PASSWORD_REP: The maximum number of characters that may repeat consecutively in a password. For example, if this parameter was set to three, a password like AAAA01 would not be allowed (although AAA001 and AA01AA would be allowed).
- PASSWORD_REP_TIME: The value in this field is the amount of time (in days) in which a password cannot be repeated. (If the value is zero, there is no constraint on the re-use of passwords.)
- PASSWORDS_ENCRYPTION: When this check box is selected, the system encrypts passwords before storing them in the database.
- PRETIMEOUT_WARNING_TIME: This is the time (in minutes) prior to session timeout when a user gets a warning message that his or her session is about to expire. (The warning appears in a pop-up window.) If this parameter is set to zero, then a warning message is not generated.
- SECURITY_QUESTIONS_NUM: When the Forgotten Password feature is enabled, this field sets the number of security questions that the user must configure.
- SECURITY_ANSWER_MIN_LENGTH: This is the minimum number of characters required for the answer(s) to the security question(s) used for the Forgotten Password feature.
- SESSION_TIMEOUT: When no activity occurs for the time (in minutes) specified by this parameter, the system will automatically log-out the user. If this parameter is set to zero or null, a user's session will never time-out.
- USE_SECURITY_QUESTIONS: This check box, when selected, enables the Forgotten Password feature.
Additional information about these parameters can be found on the System Parameters topic.
