This topic covers configuration of password authentication in the database:

Password Strength

User passwords can be set to either "weak" or "strong" rules.

Weak rules require only that the password

  • Must be more than 6 characters long.
  • Must not match the user's email address.
Strong rules require that passwords meet the following criteria:
  • Must be eight or more characters long.
  • Must contain characters from at least three of the following character types:
    • lowercase letter (a-z)
    • uppercase letter (A-Z)
    • digit (0-9)
    • symbol (! @ # $ % & / < > = ?)
  • Must not contain a sequence matching three or more characters from the user's email, address, display name, first name or last name.
  • Must not match any of the user's 10 previous passwords.

Password Expiration

Administrators can also set the password expiration interval. Available expiration intervals are:

  • Never
  • Every five seconds - for testing purposes
  • Three months
  • Six months
  • Twelve months

Password Best Practices for LDAP and SSO Users

For installations that run on LDAP or SSO authentication servers, it is recommended that at least one Site Administrator account be associated with LabKey's internal database authenticator as a failsafe. This will help prevent a situation where all users and administrators become locked out of the server should the external LDAP or SSO system fail or change unexpectedly. If there is a failure of the external authentication system, a Site Administrator can sign in using the failsafe database account and create new database authenticated passwords for the remaining administrators and users, until the external system is restored.

To create a failsafe database-based password:

  • Select (User).
  • Choose Create Password. (This will create a failsafe password in the database.)
  • Enter your password and click Set Password.

After setting up a failsafe password in the database, LabKey Server will continue to authenticate against the external LDAP or SSO system, but it will attempt to authenticate using database authentication if authentication using the external authentication system fails.

Related Topics

Discussion

previousnext
 
expand all collapse all