VERISCO Shield Authenticate

Password policy

The rules a new password must meet. They apply when a password is set through VERISCO, which requires write access to your directory.

Set on Password Policy in your console.

The Password Policy page for a read-only directory: a notice says the rules are not in effect, and the presets are shown disabled. — Password Policy with a read-only directory: shown, and disabled with the reason.

Read-only directories

When your MySQL identity source is in read-only mode, passwords are only ever set in your own application, so VERISCO has nothing to enforce. The page is shown disabled, with that reason. Your existing passwords keep working either way: the policy is checked when a password is set, never when it is used.

Presets#

	Minimum length	Uppercase	Lowercase	Digits	Special	History	Expiry
Basic	8	1	1	1	0	3	Never
Recommended	10	1	1	1	1	5	Never
Strict	12	2	2	2	2	10	90 days

A tenant that never opens the page starts on Recommended. You can start from a preset and change any value.

Settings#

Setting	Meaning
Minimum length	The fewest characters a password may have.
Uppercase, lowercase, digits, special	The fewest characters of each kind. Zero means not required.
History	How many of a user's previous passwords they may not reuse.
Expiry	Days until a password must be changed. Never, when zero.

Choosing values#

Length does more than complexity. A long password with no symbol is harder to guess than a short one with three. Prefer a longer minimum over more required character kinds, and prefer multi-factor authentication over frequent expiry: forced rotation mostly produces predictable variations of the old password.

Something missing or wrong on this page? Tell us and we will fix it.