PasswordCredentialsPolicyType (Complex Type)

Items

• storageMethod

  Flags: RAM,runtime

  Multiplicity: [0,1]

  Method used to store the values of this credential (encrypted, hashed, ...) If storage method is not specified it defaults to encryption (due to compatibility and convenience reasons).

• resetMethod

  Flags: RAM,runtime

  Multiplicity: [0,1]

  Specifies the method of resetting the credential. This usually applies to a self-service credential reset.

• propagationUserControl

  Flags: RAM,runtime,AVals:2

  Multiplicity: [0,1]

  Constraints that define how propagation of the credentials can be controlled by the user. E.g. if user can choose where the password change will be propagated.

• minOccurs

  Flags: RAM,runtime

  Multiplicity: [0,1]

  Minimal number of value occurrences. minOccurs set to zero means that the value is optional. E.g. when applied to passwords the minOccurs=0 means that the policy will accept no password at all. But it will still validate the password using stringPolicy if a password is present.

• maxOccurs

  Flags: RAM,runtime

  Multiplicity: [0,1]

  Maximal number of value occurrences. If not specified then the default schema limitation is imposed.

• maxAge

  Flags: RAM,runtime

  Multiplicity: [0,1]

  Maximum age of the credential, counted from the last credential value update. The credential must not be used after the age is exceeded (it is expired). Any authentication with such credential must fail.

• minAge

  Flags: RAM,runtime

  Multiplicity: [0,1]

  Minimum age of the credential, counted from the last credential value update. The credential cannot be changed before its minimal age is reached.

• warningBeforeExpirationDuration

  Flags: RAM,runtime

  Multiplicity: [0,1]

  The time interval before credential expiration (exceeded maxAge) that the user will be warned that the credential is about to expire.

• lockoutMaxFailedAttempts

  Flags: RAM,runtime

  Multiplicity: [0,1]

  Maximum number of failed authentication attempts that can be tried before the credential is locked-out.

• lockoutFailedAttemptsDuration

  Flags: RAM,runtime

  Multiplicity: [0,1]

  The duration in which the failed attempts must happen for the credential to be locked-out. The failed attempt counter is re-set after this duration (counted from the last failed attempt). The credential is NOT locked-out during this duration.

• lockoutDuration

  Flags: RAM,runtime

  Multiplicity: [0,1]

  The duration for which the credential remains locked-out. The credential is automatically unlocked after this duration.

• valuePolicyRef

  Flags: RAM

  Multiplicity: [0,1]

  Reference to the value policy for the credential.

• historyLength

  Flags: RAM,runtime

  Multiplicity: [0,1]

  The number of entries to keep in the credential history. Also specifies the number of past credential values that will be checked before accepting a new credential change.

• historyStorageMethod

  Flags: RAM,runtime

  Multiplicity: [0,1]

  Method used to store historical values of the credential (encrypted, hashed, ...) If storage type is not specified then it defaults to hashing.

• passwordChangeSecurity

  Flags: RAM,runtime,AVals:2

  Multiplicity: [0,1]

  Additional security applied when changing a password. This applies when user is changing his own password. It does NOT apply when administrator changes password of other user.