Overview

Password policies are part of the wider security environment but since they control from where and when a user can access the system.

How to create Password Policies

From the Permissions menu (Admin > Users & Permissions) you can see a list of any existing password policies in your system. To edit a existing password Police just click on its name. You can create a new Policy by clicking the Add Policy button towards the top right of the screen.

The settings for a Password Policy

General settings

Policy name	The name of the policy to be applied
Description	A description of the password policy
Expiry (days)	Number of days until the password expires
Repeat password limit	Prevents the user from reusing the same password within the selected number of recent passwords.

Password requirements

Minimum length	Required minimum number of characters. The default minimum is 6 characters.
Mixed-case	Require a combination of upper and lower case letters
Numbers	Require at least 1 number
Special characters	Require at least 1 non-alphanumeric character, such as #, $ or %

Days and time restrictions

Enable	Restrict login access by days and time
Restrict access before	Time, set in military time, before which the user will not be able to access the system
Restrict access after	Time, set in military time, after which the user will not be able to access the system
Allow access on days	Controls which days the user can log in

IP address restrictions

Enable

Restrict login access by IP address

IP address with mask

Restrict access to a specific IP address. This prevents the user from accessing the system from networks that are not designated. This can be useful to restrict access to only your office.

To find your IP address, search 'What is my IP address' into a search engine.

Enter your IP address and add '/32'

Add row

Allows the designation of additional IP addresses.

Applying a Password Policy to a user

Password Policies are applied against system roles in Actionstep. If you go to your System Roles screen (Admin > Users & Permissions > System Roles) and click on the name of any of the listed system roles to edit them, you will see a field where you can select any Password Policy you have created in your system.

Any login that you link to that system role thereafter will have the restrictions you set in the password policy applied to their login.

If a user has multiple logins with one email address, like having a login which can access more than one Actionstep database, with more than one Password Policy then the more restrictive components from all of the policies will be applied. For example, if you requires 6 character minimum and the other 8 then the user will require a password with 8 characters, if the first password policy required the password to expire after 20 days and the second after 30 days, then the user's password would expire after 20 days.