← Back to plugin index

User Data Blacklist Password Policy
Description
A password policy to check whether the new password corresponds to user data such as the user's name, home town, birth date, etc.

The items on the black-list - which will not be accepted as new password - must be part of the context data of the user or the username itself.

The plugin can be configured to either look at all context data or selected pieces of context data (see configuration properties below). The user name is handled separately.

Because birth dates (and other dates) are of special interest in this check, the configuration allows to specify one or more date-conversion patterns. If they are provided, the plugin converts any dates in the context data using all specified patterns when comparing them to the new password.

All pieces of context data that are not of type string and not of type date are converted to a string by calling the toString()-method on the object.

Type name
PwdPolicyUserDataBlacklistCheck
Class
com.airlock.iam.core.misc.impl.authen.PwdPolicyUserDataBlacklistCheck
May be used by
Customizable Password Policy Customizable Password Policy Meta Password Policy
Properties
Check User Name (checkUserName)
Description
If this property is set to TRUE, the new password will also be checked against the username (which is usually not part of the context data).
Note that this property does not depend on the selected context data items. Example: If the username is part of the context data and this property is FALSE, the username will be used nevertheless because it is part of context data.
Attributes
Boolean
Optional
Default value
true
Selected Context Data (selectedContextData)
Description
A of keys referencing the pieces of context data to include in the check. The special value "@ALL" can be used to reference all context data items.
Attributes
String-List
Optional
Conversion Patterns (conversionPatterns)
Description
Zero one or more date patterns used for the comparison the new passwords with dates or timestamps in the context data.
All dates or timestamps (everything with type java.util.Date or a subclass) in the context data is converted using all provided date-format patterns with this property.

The data-format patterns are as specified in JDK 1.6 Java class SimpleDateFormat.

Attributes
String-List
Optional
Ignore Case (ignoreCase)
Description
If set to TRUE, the case of characters is ignored when comparing the new password to the black-list items.
Attributes
Boolean
Optional
Default value
false
Comparison Strategy (comparisonStrategy)
Description
Specifies how user data is matched against the password.
  • EQUALS: the policy triggers if user data exactly matches the password (default).
  • CONTAINS: the policy triggers if the password contains user data.
Attributes
Enum
Optional
Default value
EQUALS
YAML Template (with default values) 

type: PwdPolicyUserDataBlacklistCheck
id: PwdPolicyUserDataBlacklistCheck-xxxxxx
displayName: 
comment: 
properties:
  checkUserName: true
  comparisonStrategy: EQUALS
  conversionPatterns:
  ignoreCase: false
  selectedContextData: