This document describes the configuration of a password policy for DigDash Enterprise.

The password policy configuration is separated in two parts:

• The strategies of protection, life cycle, and a part of the password quality are defined directly in the LDAP server natively supported by DigDash Enterprise (OpenLDAP 2.0+)
• The password quality rules (syntax) are defined in a configuration file in DigDash Enterprise.

For the LDAP configuration part, we recommend the use of the software Apache Directory Studio.

• Accessing LDAP Password Policy
  • Main attributes description
• Password Quality Configuration (Digdash Enterprise specific)
  • File format of passwordpolicyrepository.xml
  • Rule parameters
  • Advance grammar with the Pattern parameter (regular expressions)
  • Error Messages

Accessing LDAP Password Policy

The password policy in LDAP is enabled through an LDAP interceptor (enabled by default). To configure it you can connect to the DigDash Enterprise LDAP with Apache Directory Studio, with an LDAP administrator user.

Once connected, expand the following nodes (see screenshot for more details):

• ou=config
• ads-directoryServiceId=default
• ou=interceptors
• ads-interceptorId=authenticationInterceptor
• ou=passwordPolicies
• ads-pwdId=default

Main attributes description

The following table describes the main attributes used to configure the password policy in Apache Directory Server:

Password Quality Configuration (Digdash Enterprise specific)

By default DigDash Enterprise stores hashed passwords in LDAP. So LDAP does not know the original password entered by the user, and so can not check the its quality.

This check is done directly within DigDash Enterprise.

This chapter describes how to specify constraint on password within DigDash Enterprise.

Password quality rules are defined in the passwordpolicyrepository.xml file.

A default file is delivered with DigDash Enterprise, but does not define any constraint on user passwords. The default configuration file is located in the ddenterpriseapi web application folder but it is not recommended to directly modify it at this location, unless loosing the modification in a future DigDash Enterprise upgrade.

To modify the password quality rules the simplest procedure is:

1. Copy the default file located at the following place:
    <DDE Install>/apache-tomcat/webapps/ddenterpriseapi/WEB-INF/ classes/resources/config/passwordpolicyrepository.xml
    to the following place:
    <user>/Application Data/Enterprise Server/ddenterpriseapi/config/  passwordpolicyrepository.xml
2. Modify the copy with a text editor
3. Restart the Tomcat server after the modification.

File format of passwordpolicyrepository.xml

The default file contains the following XML:

It defines two rules, one for the DigDash Enterprise administrator profile (admin...), and the other for the profile of the other users. The two rules have the same syntax.

These two profiles will allow to specify a different password quality for the administrators and the regular users.

Rule parameters

Advance grammar with the Pattern parameter (regular expressions)

The Pattern parameter is used to specify complex constraints on passwords by using regular expressions syntax.

This document is not a reference on regular expressions. We will give only some examples of expression that can be useful in frequent cases.

For a reference on regular expression, we are using Java Regex when checking the pattern.

Examples:

• All strings: .*
• Specify a minimum string length: .{8,}
• Specify a minimum and maximum string length: .{8,20}
• Forbid spaces and tabs: (?=\S+$).*
• At least one digit: (?=.*[0-9]).*
• At least one lower-case letter: (?=.*[a-z]).*
• At least one upper-case letter: (?=.*[A-Z]).*
• At least one special character: (?=.*[@#$%^&+=_\-]).*

It is possible to group these expressions in one regular expression, for instance:

((?=.*[0-9])(?=.*[a-z])(?=.*[A-Z])(?=.*[@#$%^&+=])(?=\S+$).{8,})

(Note the parenthesis surrounding the combined expression)

Error Messages

Parameters Pattern, MustHaveUpperCase, MustHaveLowerCase, MustHaveNumeric, MustHaveSpecialChar and MustNotContainID can specify an optional attribute msg that will be displayed if the corresponding rule is not respected when the user enter a new password.

Example: