Terra Dotta's Password Management feature offers several site configuration options related to the password security settings for your site's external/non-integrated users.
This article discusses the following options related to Password Management:
- Access & Permission
- Password Strength Settings
- Password Longevity Settings
- Additional Security Options
- Resetting a Password
Access & Permission
To access Password Management, navigate to Settings > System Features and click on the "Administrative" tab. Then scroll down the page to locate the Password Management section. The settings can be managed by any user with administrator permissions.
Important Note: These settings are not applicable to integrated users logging in through a Secure Campus Login (SCL) integration portal. The settings will be used for any user that will be using a password issued to them by your site's software.
Password Strength Settings
Minimum character length: This field refers to the minimum required amount of characters a password must contain and is set at a default of eight characters. Exceeding the character length is acceptable. To change the setting, type in the new password minimum required length using a numeric character and click "Update" to preserve your changes.
Require both upper and lower case letters in password: This setting determines if permanent passwords must have at least one upper and one lower case letter to be an acceptable permanent password. The default status for this setting is "enabled", meaning that it is required. To disable the requirement for upper and lower case letters in the password, uncheck the "Enable" box to the right of this setting to remove the check mark. Click "Update" to preserve your changes.
Require at least one number in password: This setting, when enabled, requires users to select at least one number as part of the permanent password. The default status for this setting is "enabled". To disable the requirement for at least one number to appear in a password, uncheck the "Enable" box next to the right of this setting to remove the check mark. Click "Update" to preserve your changes.
Require at least one symbol in password: This setting, when enabled, requires users to select at least on symbol as part of the permanent password. The default status for this setting is "enabled". To disable the requirement for at least one symbol to appear in a password, uncheck the "Enable" box next to the right of this setting to remove the check mark. Click "Update" to preserve your changes.
Require both upper and lower case letters in password: This setting determines if permanent passwords must have at least one upper and one lower case letter to be an acceptable permanent password. The default status for this setting is "enabled", meaning that it is required. To disable the requirement for upper and lower case letters in the password, uncheck the "Enable" box to the right of this setting to remove the check mark. Click "Update" to preserve your changes.
Require at least one number in password: This setting, when enabled, requires users to select at least one number as part of the permanent password. The default status for this setting is "enabled". To disable the requirement for at least one number to appear in a password, uncheck the "Enable" box next to the right of this setting to remove the check mark. Click "Update" to preserve your changes.
Require at least one symbol in password: This setting, when enabled, requires users to select at least on symbol as part of the permanent password. The default status for this setting is "enabled". To disable the requirement for at least one symbol to appear in a password, uncheck the "Enable" box next to the right of this setting to remove the check mark. Click "Update" to preserve your changes.
Password Longevity Settings
The following settings are applicable to both temporary and permanent passwords:
Number of days temporary passwords are valid: The numerical value entered in this field represents the number of days for which a temporary password will remain valid for new users or users resetting their passwords. The default setting for this field is one day. To change the number of days for which a temporary password is valid, enter the desired numerical value in the field and click "Update" to preserve your changes.
Important Note: This setting affects the number of days that a new external recommender or reviewer's password is valid.
Number of days permanent passwords are valid: The numerical value entered in this field represents the number of days for which a permanent password will remain valid for system users. The default setting for this field contains no value (i.e. "blank"), which means there is no expiration set for permanent passwords. To change the number of days for which a permanent password is valid, enter the desired numerical value in the field and click "Update" to preserve your changes.
Important Note: Changes made to either of these settings do not affect current temporary and permanent passwords. These changes only affect temporary and permanent passwords that are generated after an update to a setting has been made.
Additional Security Options
Additional security options are available under Password Management to prevent brute-force attacks on user authentication. These include automated scripts or extremely persistent hackers attempting to repeatedly guess a password.
User/IP address blocking due to multiple failed login attempts: This section of Password Management contains three configurable fields which collectively dictate the action that is taken when the following conditions are met: When X number of failed login attempts within X number of minutes are made to the site, then block the associated User/IP address for X number of minutes.
User/IP address blocking due to multiple failed login attempts: This section of Password Management contains three configurable fields which collectively dictate the action that is taken when the following conditions are met: When X number of failed login attempts within X number of minutes are made to the site, then block the associated User/IP address for X number of minutes.
Each field (labeled as "A", "B", and "C" in the image below) refers to the following information:
A) Failed Attempts Within: A numerical value in this field represents the number of failed login attempts a user makes when trying to login. Enter a desired numerical value and click "Update" to preserve your changes.
B) This field refers to the number of minutes in which the failed attempts occurred.
C) This field refers to the number of minutes that a user will be blocked from attempting to login again.
The setting for this User/IP address blocking is "disabled" by default. To enable this setting, check the box next to "Enable" and click "Update" to preserve your changes.
Should it be desired to enable this functionality, the recommended settings for these fields are 5 failed login attempts within 2 minutes will block the User/IP address for 5 minutes. These settings can be adjusted by entering numeric values in each field and clicking "Update" to preserve your changes.
Important Note: Many offices and computer labs use a single wireless access point or router for multiple computers. If an IP address is blocked using this security option, then the IP address of that specific wireless access point is blocked. Thus, if you have staff members using the same wireless router and one person triggers the IP blocking, then all staff using that wireless router will be blocked from logging in for the configured number of minutes.
Password reset security question: This security option is comprised of two possible settings:
1) Enable password reset by users without security questions.
When enabled, this setting allows a new user who has been issued a temporary password that has expired the ability to reset their own password even if that user has not set up security questions. This means that the user does not have to contact an admin user for assistance.
If this setting is not enabled, then the user will be prompted to contact their office for assistance with the password reset after clicking "Forgot your password".
By default, this setting is disabled. To enable this setting, check the box next to "Enable password reset by users without security questions" and click "Update" to preserve your changes.
2) Lock account reset after failed attempt.
When enabled, this setting will lock the account for a predetermined time if a user tries to login and is unsuccessful. The account will remain locked until the time limit has passed or the user contacts an admin to take action.
An admin user can click on "view/unlock accounts" to see a list of locked accounts to take action on.
By default, this setting is disabled. To enable this setting, check the box next to "Lock account reset after failed attempt" and click "Update" to preserve your changes.
Resetting a Password
A non-integrated user's password can be reset in Maintenance > Edit User using the "Send Reset Email" button. This will issue them a temporary password and reset their security questions.
An integrated user will need to reset their password through your SIS/HR directory.