Multiple policies

Use multiple policies when different password rules should apply to different users. For example, students, teachers, and administrators can have separate policies with different requirements for password length and complexity.

How PasswordReset selects a policy

PasswordReset selects a policy from the session parameter password_policy.

When authentication is performed using a SAML identity provider, the identity provider includes password_policy in the SAML assertion. The value is normally determined from the user's group membership or attributes and must match the id of one of the configured policies.

For example, group membership or an attribute can be mapped as follows:

User type	password_policy value	Applied policy
Student	student	Simpler password requirements
Teacher	teacher	Stronger password requirements
Administrator	administrator	Strictest password requirements

PasswordReset uses the matching policy for both the rules displayed to the user and the validation performed when the password reset is submitted.

If password_policy is missing, empty, or does not match a configured policy, PasswordReset uses the policy where default is set to true.

For SAML authentication, see SAML assertion parameters for details about the password_policy assertion attribute.

Configure the policies

The rules.json file is located in <installation path>\pwdreset\config\modules\rules, where the installation path depends on the operating system and installation setup.

This configuration assumes that the PasswordReset module in pwdreset.json includes the policy file through rule_policies, for example "rule_policies" : "@include:rules/rules.json".

Example of a multiple policy configuration:

[
  {
    "id": "default",
    "default": true,
    "rules": [
      {
        "type": "lengthMin",
        "min": 8,
        "description": "password_reset.rules.lengthMin"
      },
      {
        "type": "uppercase",
        "description": "password_reset.rules.uppercase"
      },
      {
        "type": "lowercase",
        "description": "password_reset.rules.lowercase"
      },
      {
        "type": "special",
        "description": "password_reset.rules.special"
      },
      {
        "type": "number",
        "description": "password_reset.rules.number"
      }
    ]
  },
  {
    "id": "student",
    "rules": [
      {
        "type": "lengthMin",
        "min": 6,
        "description": "password_reset.rules.lengthMin"
      },
      {
        "type": "uppercase",
        "description": "password_reset.rules.uppercase"
      },
      {
        "type": "lowercase",
        "description": "password_reset.rules.lowercase"
      },
      {
        "type": "number",
        "description": "password_reset.rules.number"
      }
    ]
  },
  {
    "id": "teacher",
    "rules": [
      {
        "type": "lengthMin",
        "min": 10,
        "description": "password_reset.rules.lengthMin"
      },
      {
        "type": "uppercase",
        "description": "password_reset.rules.uppercase"
      },
      {
        "type": "lowercase",
        "description": "password_reset.rules.lowercase"
      },
      {
        "type": "special",
        "description": "password_reset.rules.special"
      },
      {
        "type": "number",
        "description": "password_reset.rules.number"
      }
    ]
  },
  {
    "id": "administrator",
    "rules": [
      {
        "type": "lengthMin",
        "min": 14,
        "description": "password_reset.rules.lengthMin"
      },
      {
        "type": "uppercase",
        "description": "password_reset.rules.uppercase"
      },
      {
        "type": "lowercase",
        "description": "password_reset.rules.lowercase"
      },
      {
        "type": "special",
        "description": "password_reset.rules.special"
      },
      {
        "type": "number",
        "description": "password_reset.rules.number"
      }
    ]
  }
]

Multiple policies control which password rules PasswordReset validates. Password expiration in Active Directory, such as 30 or 90 days, is configured separately through Active Directory password policies or Fine-Grained Password Policies.