This topic is under construction for the 17.3 release of LabKey Server. For current documentation of this feature, click here.
This topic covers configuration of password authentication in the database:
User passwords can be set to either "weak" or "strong" rules.Weak
rules require only that the password
- Must be more than 6 characters long.
- Must not match the user's email address.
rules require that passwords meet the following criteria:
- Must be eight or more characters long.
- Must contain characters from at least three of the following character types:
- lowercase letter (a-z)
- uppercase letter (A-Z)
- digit (0-9)
- symbol (! @ # $ % & / < > = ?)
- Must not contain a sequence matching three or more characters from the user's email, address, display name, first name or last name.
- Must not match any of the user's 10 previous passwords.
Administrators can also set the password expiration interval. Available expiration intervals are:
- Every five seconds - for testing purposes
- Three months
- Six months
- Twelve months
Password Best Practices for LDAP and SSO Users
For installations that run on LDAP or SSO authentication servers, it is recommended that at least one Site Administrator account be associated with LabKey's internal database authenticator as a failsafe. This will help prevent a situation where all users and administrators become locked out of the server should the external LDAP or SSO system fail or change unexpectedly. If there is a failure of the external authentication system, a Site Administrator can sign in using the failsafe database account and create new database authenticated passwords for the remaining administrators and users, until the external system is restored.
To create a failsafe database-based password:
- Select (User).
- Choose Create Password. (This will create a failsafe password in the database.)
- Enter your password and click Set Password.
After setting up a failsafe password in the database, LabKey Server will continue to authenticate against the external LDAP or SSO system, but it will attempt to authenticate using database authentication if authentication using the external authentication system fails.