CredentialPolicyType (Complex Type)

Items

• name

  Flags: RAM,runtime

  Multiplicity: [0,1]

  Unique name of the credential. This name is fact a short identifier. It is supposed to give some idea about purpose of the credential to system administrator. It is also used for referencing the credential when needed (e.g. from authentication modules, credential reset specs, etc.) The name may be stored in the user object together with the credential. But it is not supposed to be used as a user-friendly label for credential. Credential name must be unique.

  Credential name is optional, mostly due to historical/compatibility reasons.

  This is a credential policy. Which means that it controls how credentials are set (stored). It does not control how credentials are used for authentication. That is controlled by the authentication module setting - and in fact this may even be out of our control completely, e.g. in case that external authentication is used (SSO).

• description

  Flags: RAM,runtime

  Multiplicity: [0,1]

  Free form description of the credential (administrator comment).

• documentation

  Flags: RAM,runtime

  Multiplicity: [0,1]

  Technical documentation for a particular object or construct.

  The purpose of this element is to document system configuration and behavior. The documentation will not be presented to end users. In fact, it will probably not be presented at all in midPoint user interface. This documentation element is supposed to be a part of the technical documentation of midPoint deployment. The tools than generate deployment configuration will look for these elements and combine them to compiled documentation document.

  AsciiDoc formatting is assumed for this element. Any leading or trailing whitespace is skipped. Indentation equivalent to he indentation of the first non-blank line of text is also skipped.

• storageMethod

  Flags: RAM,runtime

  Multiplicity: [0,1]

  Method used to store the values of this credential (encrypted, hashed, ...) If storage method is not specified it defaults to encryption (due to compatibility and convenience reasons).

• resetMethod

  Flags: RAM,runtime

  Multiplicity: [0,1]

  Specifies the method of resetting the credential. This usually applies to a self-service credential reset.

• propagationUserControl

  Flags: RAM,runtime,AVals:2

  Multiplicity: [0,1]

  Constraints that define how propagation of the credentials can be controlled by the user. E.g. if user can choose where the password change will be propagated.

• minOccurs

  Flags: RAM,runtime

  Multiplicity: [0,1]

  Minimal number of value occurrences. minOccurs set to zero means that the value is optional. E.g. when applied to passwords the minOccurs=0 means that the policy will accept no password at all. But it will still validate the password using stringPolicy if a password is present.

• maxOccurs

  Flags: RAM,runtime

  Multiplicity: [0,1]

  Maximal number of value occurrences. If not specified then the default schema limitation is imposed.

• maxAge

  Flags: RAM,runtime

  Multiplicity: [0,1]

  Maximum age of the credential, counted from the last credential value update. The credential must not be used after the age is exceeded (it is expired). Any authentication with such credential must fail.

• minAge

  Flags: RAM,runtime

  Multiplicity: [0,1]

  Minimum age of the credential, counted from the last credential value update. The credential cannot be changed before its minimal age is reached.

• warningBeforeExpirationDuration

  Flags: RAM,runtime

  Multiplicity: [0,1]

  The time interval before credential expiration (exceeded maxAge) that the user will be warned that the credential is about to expire.

• lockoutMaxFailedAttempts

  Flags: RAM,runtime

  Multiplicity: [0,1]

  Maximum number of failed authentication attempts that can be tried before the credential is locked-out.

• lockoutFailedAttemptsDuration

  Flags: RAM,runtime

  Multiplicity: [0,1]

  The duration in which the failed attempts must happen for the credential to be locked-out. The failed attempt counter is re-set after this duration (counted from the last failed attempt). The credential is NOT locked-out during this duration.

• lockoutDuration

  Flags: RAM,runtime

  Multiplicity: [0,1]

  The duration for which the credential remains locked-out. The credential is automatically unlocked after this duration.

• valuePolicyRef

  Flags: RAM

  Multiplicity: [0,1]

  Reference to the value policy for the credential.

• historyLength

  Flags: RAM,runtime

  Multiplicity: [0,1]

  The number of entries to keep in the credential history. Also specifies the number of past credential values that will be checked before accepting a new credential change.

• historyStorageMethod

  Flags: RAM,runtime

  Multiplicity: [0,1]

  Method used to store historical values of the credential (encrypted, hashed, ...) If storage type is not specified then it defaults to hashing.