How To: Configure Enforce Password Change with a Minimum Password Age Requirement

Version Affected: All

 

Overview

This article explains how the Enforce Password Change Requirement setting interacts with Active Directory's minimum password age policy, and how to configure it for your realm. The steps depend on the SecureAuth IdP/Identity Platform version.

• Use Method 1 if running SecureAuth IdP 9.0 or earlier.
• Use Method 2 if running 20.06 HF11 / 21.04 HF5 or later.
   

In this article

• Method 1: SecureAuth IdP 9.0 and Earlier
• Method 2: 20.06 HF11 / 21.04 HF5 and Later

Method 1: SecureAuth IdP 9.0 and Earlier

When using Enforce Password Change Requirement, SecureAuth IdP sets two passwords in sequence: a randomly generated password, then the user's new password. This intermediate password is known only to the IdP: an internal randomizer selects from upper-case letters, lower-case letters, numbers, and the special characters !@#$%^&*()_+/, drawing one character group at a time and cycling through all the groups until the password reaches the minimum length set in the realm's password complexity requirements. This conflicts with an AD policy that has a minimum password age of 1 day or greater, since AD blocks the second change. Use this method to configure the reset realm so Enforce Password Change Requirement works alongside a minimum password age of 1 or greater.

1. Go to the Password Reset Configuration page.
2. Switch Password Reset Mode to Administrative Password Reset.
3. Set Must Change Password at Next Logon to True.
4. Click Save.
5. Switch Password Reset Mode back to Enforce Password Change Requirements. Leave Must Change Password at Next Logon set to True — once switched, this setting is hidden but remains selected.
6. Click Save.

Method 2: 20.06 HF11 / 21.04 HF5 and Later

Starting in 20.06 HF11 and 21.04 HF5 (EE-1968), Enforce Password Change Requirement now respects the Minimum Password Age set within the SecureAuth password complexity requirements. Previously, a user could use Enforce Password Change Requirement to change their password as many times as needed, potentially cycling back to their original password to bypass password history.

If you have a requirement that means you don't want to enforce a minimum password age — for example, onboarding new users — set Minimum Password Age to 0 in the Post Auth tab for the password reset realm.

Special Considerations

We don't recommend setting Minimum Password Age to 0, since it allows a user to cycle through passwords to bypass password history.


 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.