The user store to verify and change passwords.

The capabilities and the configuration of the user store influence the capabilities of this plugin. If, for example, the user store does not load or store information about the latest password change, this plugin will not be able to use this information.

Active Directory Connector Custom User Persister-based User Store Provider Database User Store Extended User Persister-based User Store Provider LDAP Connector User Persister-based User Store

The number of days a password may be used before it must be changed.

If a password is changed, this plugin sets the latest-password-change-timestamp and (if this property is defined) also updates the next-enforced-password-change-timestamp.

If this property is not defined, the next-enforced-password-change-timestamp is not updated.

The password hash function used for verification and password change. This property is required if the existing (current) password should be checked directly using the user store plugin (see also plugin description above) and also when storing a new password.

Note that the password hash function may or may not support password history checks. If the configured password hash function does not support password history checks but a policy checker requires this capability, the history check is omitted and a log warning is written.

NOTE: Some password hashes, such as SHA 256 Password Hash or Scrypt Password Hash, produce binary output. If one of these is used, make sure the persistence layer supports binary data in the hash field and the corresponding persistence plugins (e.g. Database User Store or Ldap Connector) are configured to treat hash values as binary values.
In case the persistence layer expects a string, encode the password hash by wrapping it with an encoder. To achieve this, use the Password Hash Configuration plugin and specify the hash function (such as Scrypt Password Hash) together with the desired encoder. We recommend using the Base64 Password Hash Encoder.

AWS KMS Password Hash Argon2id Password Hash Bcrypt Password Hash Combined Password Hash Encrypted Password Hash History Password Hash Identity Password Hash LDAP Password Hash MD5 Base64 Password Hash MD5 Hex Password Hash Multi Password Hash (LDAP-style) Password Hash Configuration SHA1 Base64 Password Hash SHA1 Hex Password Hash SHA1 Password Hash SHA256 Base64 Password Hash SHA256 Hex Password Hash SHA256 Password Hash Scrypt Password Hash

An authenticator plugin used to verify the existing (current) password during the password change.

If this property is provided, the specified plugin is called with the username and password to verify the existing (current) password instead of loading the user data and comparing the password hashes (see also plugin description).

Accepting Authenticator Active Directory Connector Airlock 2FA Authenticator Certificate Authenticator Certificate Token Authenticator Configuration-based Authenticator Credential-based Authenticator Selector Denying Authenticator Dummy Matrix Authenticator Dummy Polling Authenticator Dummy Two Step Authenticator Email Otp Authenticator Fallback Authenticator LDAP Connector LDAP Password Authenticator Lookup and Accept Authenticator MTAN/SMS Authenticator Main Authenticator Matrixcard Authenticator (TAN Challenge) Meta Authenticator NextGenPSD2 Certificate Authenticator OATH OTP Authenticator OAuth 2.0 Access Token Authenticator Password Authenticator RADIUS Authenticator SSO Credential Authenticator STET PSD2 Authenticator Selection Authenticator Static Authenticator Token Authenticator User-based Authenticator Selector

If the password cannot be verified using the main "Hash Function" above, all hashes in this list are tried as well. If any hash of this list matches, the password is stored using the current main hash function (see property "Hash Function"). In this case, a potential password history is lost.

This feature allows changing the password hash function with automatic migration of all users that log in.

Notice that having a legacy hash function in this list producing the same output length as the main hash function can pose a security risk since it might be possible for an attacker to provoke a match using a weaker hash method.

AWS KMS Password Hash Argon2id Password Hash Bcrypt Password Hash Combined Password Hash Encrypted Password Hash History Password Hash Identity Password Hash LDAP Password Hash MD5 Base64 Password Hash MD5 Hex Password Hash Multi Password Hash (LDAP-style) Password Hash Configuration SHA1 Base64 Password Hash SHA1 Hex Password Hash SHA1 Password Hash SHA256 Base64 Password Hash SHA256 Hex Password Hash SHA256 Password Hash Scrypt Password Hash

If enabled, passwords containing special characters stored by IAM earlier than 6.3 are still accepted. This option does not have to be activated if all passwords were set using IAM 6.3 or later or if all passwords were set via webservices or REST.

To support legacy passwords, those with special characters are additionally checked using their legacy encoding in latin1 and if matching, they are rehashed and stored using the current hash function. In this case, a potential password history is lost.

false

If enabled, all failed checks on passwords longer than 50 characters will lead to a second check using only the first 50 characters. If successful, the full password is stored.

Prior to IAM 7.3 the password input field on JSPs was limited to 50 characters, with overflowing characters being truncated by the browser. This limit has been removed with IAM 7.3, leading to the full password being sent to IAM. For new installations with IAM 7.3 or later, this setting should not be enabled.

false

The number of wrong old passwords during a password change before a user is locked.

Warning: Make sure that number of logins is not increased by the calling application, too.

Note: The number of failed logins is increased when providing a wrong password in a password change call. When only checking a wrong password, the number of failed logins is not increased.

5