Enforce Password Change and Minimum Password Age

Version Affected:  20.06+

Description:  

From 20.06 HF11 onwards, we introduced a fix to prevent Users from bypassing the minimum password age setting in AD. 

Prior to this, the Enforce Password change option would allow the user to change their password as many times as they wanted so, in theory, they could cycle back around to their original password and avoid password history. 

This uses the "minimum password age" set within the SecureAuth password complexity requirements.


Cause:  

This feature was added in EE-1968 which is in 20.06 HF11 and 21.04 HF5 onwards. 

Resolution:  

If you have a requirement, such as onboarding new Users, that mean you don't want to enforce a minimum password age, simply set the Minimum Password age to 0 in the Post Auth tab for your password reset realm. 

Be aware that we don't recommend that though as a User could decide to cycle through passwords to bypass password history. 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.