Multiple policies

Use multiple policies when different password rules should apply to different users. For example, students, teachers, and administrators can have separate policies with different requirements for password length and complexity.

How PasswordReset selects a policy

PasswordReset selects a policy from the session parameter password_policy.

When authentication is performed using a SAML identity provider, the identity provider includes password_policy in the SAML assertion. The value is normally determined from the user's group membership or attributes and must match the id of one of the configured policies.

For example, group membership or an attribute can be mapped as follows:

User type	password_policy value	Applied policy
Student	student	Simpler password requirements
Teacher	teacher	Stronger password requirements
Administrator	administrator	Strictest password requirements

PasswordReset resolves the policy during initialization and keeps its identifier in the session for the reset request. The browser validates the displayed rules, and the reset handler forwards password_policy_id to the configured pipe. The directory or pipe must enforce any required server-side password policy; the handler does not independently evaluate the submitted password against every UI rule.

If password_policy is missing, empty, or does not match a configured policy, PasswordReset uses the policy where default is set to true.

For SAML authentication, see SAML assertion parameters for details about the password_policy assertion attribute.

Configure the policies

The rules.json file is located in <installation path>\pwdreset\config\modules\rules, where the installation path depends on the operating system and installation setup.

This configuration assumes that the PasswordReset module in pwdreset.json includes the policy file through rule_policies, for example "rule_policies" : "@include:rules/rules.json".

Example of a multiple policy configuration:

[
  {
    "id": "default",
    "default": true,
    "rules": [
      {
        "type": "lengthMin",
        "min": 8,
        "description": "password_reset.rules.lengthMin"
      },
      {
        "type": "uppercase",
        "description": "password_reset.rules.uppercase"
      },
      {
        "type": "lowercase",
        "description": "password_reset.rules.lowercase"
      },
      {
        "type": "special",
        "description": "password_reset.rules.special"
      },
      {
        "type": "number",
        "description": "password_reset.rules.number"
      }
    ]
  },
  {
    "id": "student",
    "rules": [
      {
        "type": "lengthMin",
        "min": 6,
        "description": "password_reset.rules.lengthMin"
      },
      {
        "type": "uppercase",
        "description": "password_reset.rules.uppercase"
      },
      {
        "type": "lowercase",
        "description": "password_reset.rules.lowercase"
      },
      {
        "type": "number",
        "description": "password_reset.rules.number"
      }
    ]
  },
  {
    "id": "teacher",
    "rules": [
      {
        "type": "lengthMin",
        "min": 10,
        "description": "password_reset.rules.lengthMin"
      },
      {
        "type": "uppercase",
        "description": "password_reset.rules.uppercase"
      },
      {
        "type": "lowercase",
        "description": "password_reset.rules.lowercase"
      },
      {
        "type": "special",
        "description": "password_reset.rules.special"
      },
      {
        "type": "number",
        "description": "password_reset.rules.number"
      }
    ]
  },
  {
    "id": "administrator",
    "rules": [
      {
        "type": "lengthMin",
        "min": 14,
        "description": "password_reset.rules.lengthMin"
      },
      {
        "type": "uppercase",
        "description": "password_reset.rules.uppercase"
      },
      {
        "type": "lowercase",
        "description": "password_reset.rules.lowercase"
      },
      {
        "type": "special",
        "description": "password_reset.rules.special"
      },
      {
        "type": "number",
        "description": "password_reset.rules.number"
      }
    ]
  }
]

Multiple policies select which password rules the Password Reset browser UI validates. Password expiration in Active Directory, such as 30 or 90 days, is configured separately through Active Directory password policies or Fine-Grained Password Policies.