The password_policy setting controls password length, character requirements, and zxcvbn strength checks.
Constraints & Behavior:
- zxcvbn Strength: Scores range from 1 to 4. Score 0 is not supported. A score of 2 is the default for non-privileged users, but passwords resembling common patterns are still rejected.
- Contextual Checks: Passwords may be rejected if they contain contextual values like the user's name, email, or organisation details, even if they meet length/character requirements.
- Privileged Accounts: Organisation and RapL Admins use the
privileged_min_strength_score threshold. - Updates: Every update must include all eight policy fields.
Policy Fields:
min_length (Integer): Min 6, max max_length. Default: 6.max_length (Integer): Min min_length, max 512. Default: 512.require_uppercase (Boolean): Default: false.require_lowercase (Boolean): Default: false.require_number (Boolean): Default: false.require_special (Boolean): Default: false.min_strength_score (Integer): zxcvbn score (1-4) for non-privileged users. Default: 2.privileged_min_strength_score (Integer): zxcvbn score (1-4); must be $\ge$ min_strength_score. Default: 3.
// Update example: value must be a serialized JSON string
{
"settings": [
{
"property": "password_policy",
"value": "{\"min_length\":8,\"max_length\":128,\"require_uppercase\":true,\"require_lowercase\":true,\"require_number\":true,\"require_special\":false,\"min_strength_score\":2,\"privileged_min_strength_score\":3}"
}
]
}
// Reset to default example
{
"settings": [
{
"property": "password_policy",
"reset_to_default": true
}
]
}