Password Rules

The purpose of this page is to describe how to enforce password rules.

Create your System Admin role => Password Rule window => new record.
Update the System Admin role => Client window => Technical section => Password Policy field to point to your Password Rule record.
Set Password Rule window => fields to "0" if you do not want to apply a given rule.
Since, clients are cached, be sure to either reset the cache or restart your server
Passwords are validated in the MUser.beforeSave() method. Therefore, using the Reset Password form validates as part of the MUser.save() process.

Notes:

There is a System Configurator entry "CHANGE_PASSWORD_MUST_DIFFER" that enforces that passwords must change
The system keeps a password history (AD_Password_History) and enforces that passwords must not be used twice
Validation happens in MPasswordRule.validate()