Skip to content

Fortified IDDocs

Custom rule

Use a regular expression to define your password policy.

How to add

Section titled “How to add”
{
    "type":"regex",
    "regex": "<regex_expression>",
    "description": "password_reset.rules.regex"
}

Example to disallow static and dynamic values

Section titled “Example to disallow static and dynamic values”

This example disallows the use of the static value Name-of-our-company and givenName, sn, sAMAccountName, or mail fetched from the SAML ticket in the password.

{
  "type": "regex",
  "regex": "^((?!(?i:${session.givenName})|(?i:${session.sn})|(?i:${session.sAMAccountName})|(?i:${session.mail})|(?i:Name-of-our-company)).)*$",
  "description": "password_reset.rules.regex"
}

Evaluation and test data

Section titled “Evaluation and test data”

Session expressions in a regex rule are expanded by the backend before the rule is returned. The browser then constructs a JavaScript RegExp from that string. Check the final expanded expression in every supported browser; a Java-only regular expression is not sufficient. Session values are inserted into the expression, so regex metacharacters in identity attributes need deliberate handling.

Add password_reset.rules.regex (or your own description key) to every supported language. Test both a matching and a rejected synthetic value after live validation settles. The rule does not add a server-side password check to the reset endpoint.