Password policies are part of the wider security environment but since they control from where and when a user can access the system.
How to create Password Policies
From the Permissions menu (Admin > Users & Permissions) you can see a list of any existing password policies in your system. To edit a existing password Police just click on its name. You can create a new Policy by clicking the Add Policy button towards the top right of the screen.
The settings for a Password Policy
|Policy name||The name of the policy to be applied|
|Description||A description of the password policy|
|Expiry (days)||Number of days until the password expires|
|Repeat password limit||Prevents the user from reusing the same password within the selected number of recent passwords.|
|Minimum length||Required minimum number of characters. The default minimum is 6 characters.|
|Mixed-case||Require a combination of upper and lower case letters|
|Numbers||Require at least 1 number|
|Special characters||Require at least 1 non-alphanumeric character, such as #, $ or %|
Days and time restrictions
|Enable||Restrict login access by days and time|
|Restrict access before||Time, set in military time, before which the user will not be able to access the system|
|Restrict access after||Time, set in military time, after which the user will not be able to access the system|
|Allow access on days||Controls which days the user can log in|
IP address restrictions
|Enable||Restrict login access by IP address|
|IP address with mask||
Restrict access to a specific IP address. This prevents the user from accessing the system from networks that are not designated. This can be useful to restrict access to only your office.
To find your IP address, search 'What is my IP address' into a search engine.
Enter your IP address and add '/32'
|Add row||Allows the designation of additional IP addresses.|
Applying a Password Policy to a user
Password Policies are applied against system roles in Actionstep. If you go to your System Roles screen (Admin > Users & Permissions > System Roles) and click on the name of any of the listed system roles to edit them, you will see a field where you can select any Password Policy you have created in your system.
Any login that you link to that system role thereafter will have the restrictions you set in the password policy applied to their login.
If a user has multiple logins with one email address, like having a login which can access more than one Actionstep database, with more than one Password Policy then the more restrictive components from all of the policies will be applied. For example, if you requires 6 character minimum and the other 8 then the user will require a password with 8 characters, if the first password policy required the password to expire after 20 days and the second after 30 days, then the user's password would expire after 20 days.