Configuring Password Policies

Passwords for the authentication of users are subject to certain rules. These rules are defined in the password policy. Identity Authentication provides you with two predefined password policies, in addition to which you can create and configure up to three custom password policies.

You have the following options for a password policy:

Standard

(Predefined) Use this option to set special rules for changing, resetting, and locking a password.

Note:

This is the default setting. It meets the minimum strength requirements.
Enterprise

(Predefined) Use this option to set enhanced password management features. It’s stronger than the standard policy, but weaker than the custom one.
Custom

(Configurable) Use this option to set the strongest password management features for the password policy. It's the responsibility of the tenant administrator to configure the custom password policy stronger than the standard and enterprise ones.

Remember:

This option is only possible if you’ve configured a custom password policy in the administration console for SAP Cloud Identity Services. For more information, see Configure Custom Password Policy.

Password Policy Requirements

Requirement	Standard	Enterprise	Custom
Content of password	Minimum length of 8 characters; Maximum length of 255 characters; Characters from at least three of the following groups: Lower-case Latin characters (a-z) Upper-case Latin characters (A-Z) Base 10 digits (0-9) Non-alphabetic characters	Minimum length of 8 characters; Maximum length of 255 characters; Characters from at least three of the following groups: Lower-case Latin characters (a-z) Upper-case Latin characters (A-Z); Base 10 digits (0-9) Non-alphabetic characters	Minimum length of 8 characters; Maximum length of 255 characters; Characters from between 1 and 4 of the following groups: Lower-case Latin characters (a-z); Upper-case Latin characters (A-Z); Base 10 digits (0-9); Non-alphabetic characters Note: The default is at least three of the groups.
Session time limit Indicates when the current session expires.	Yes, 12 hours	Yes, 12 hours	Yes, 12 hours
"Remember me" option Indicates whether the browser can store a cookie with the credentials.	Yes	Yes	Yes
Forgot password deactivation period Indicates the period during which users can initiate the number of forgot password emails specified by the forgot password counter.	Yes, 24 hours	Yes, 24 hours	Yes, 24 hours
Forgot password counter Indicates how many times a user can initiate forgot password emails during the deactivation period. For example, a user can initiate up to 3 forgot password emails within 24 hours.	Yes, 3	Yes, 3	Yes, 3
Minimum password age Shows the minimum lifetime of a password before it can be changed.	Unlimited	Yes, 24 hours	Yes, minimum 1 hour, maximum 48 hours
Maximum failed logon attempts Indicates how many logon attempts are allowed before the user password is locked.	Yes, 5	Yes, 5	Yes, minimum 1, maximum 6, default choice 5
Password locked period Indicates how long a password is locked for.	Yes, 1 hour	Yes, 1 hour	Yes, minimum 1 hour, maximum unlimited Note: If unlimited is set, the password can be unlocked only by the tenant administrator. For more information, see Unlock User Password. Caution: If unlimited is selected, email template set must also be changed. Otherwise, the user will receive an email stating that password logon to the account was disabled for - 1 hour. For more information, see Configuring Email Templates.
Maximum password age Shows the maximum lifetime of a password before it has to be changed.	Unlimited	Yes, 6 months	Yes, minimum 1 month, maximum unlimited Possible values: 1 month, 2 months, … 6 months; 1 year, 2 years, 3 years; unlimited
Password history Indicates whether a password history is retained, and how many passwords from the history are retained.	Unlimited	Yes, the last 5 passwords are retained.	Yes, minimum the last 5 passwords, and maximum the last 20 passwords are retained.
Maximum unused period Indicates how long the system retains unused passwords for.	Unlimited	Yes, 6 months	Yes, minimum 1 month, maximum 6 months
Password behavior Indicates possibility to force the user to reset or change password if the applied password policy requires stronger password than the current one.	Not Applicable	Scenario Based Reset password - If a user hasn’t used the password during the set user inactivity period, the system will force a password reset at the first logon after the inactivity period expires. Change password - If a user hasn't changed the password within the password lifetime, the system will force a password change at the first logon after the maximum password age period expires.	Yes, administrator can choose from: Reset password Change password

Note:

The non-alphabetic characters are all characters that are not lower-case Latin characters (a-z), upper-case Latin characters (A-Z), or base 10 digits (0-9).