# SecurityQuestionsCredentialsPolicyType (Complex Type)

### Namespace: http://midpoint.evolveum.com/xml/ns/public/common/common-3

Supertype: CredentialPolicyType
Structure that specifies policy for security questions. It actually contains text for the questions (or rather a reference to localization catalog file). But it also contains a policy how the questions can be used, e.g. how many questions to display to a user.

Item Summary
Name | Type | Multiplicity | Description
--- | --- | --- | ---
storageMethod | container CredentialsStorageMethodType | [0,1] | Method used to store the values of this credential (encrypted, hashed, .
resetMethod | container CredentialsResetMethodType | [0,1] | Specifies the method of resetting the credential.
propagationUserControl | property CredentialsPropagationUserControlType | [0,1] | Constraints that define how propagation of the credentials can be controlled by the user.
minOccurs | property string | [0,1] | Minimal number of value occurrences.
maxOccurs | property string | [0,1] | Maximal number of value occurrences.
maxAge | property duration | [0,1] | Maximum age of the credential, counted from the last credential value update.
minAge | property duration | [0,1] | Minimum age of the credential, counted from the last credential value update.
warningBeforeExpirationDuration | property duration | [0,1] | The time interval before credential expiration (exceeded maxAge) that the user will be warned that the credential is about to expire.
lockoutMaxFailedAttempts | property int | [0,1] | Maximum number of failed authentication attempts that can be tried before the credential is locked-out.
lockoutFailedAttemptsDuration | property duration | [0,1] | The duration in which the failed attempts must happen for the credential to be locked-out.
lockoutDuration | property duration | [0,1] | The duration for which the credential remains locked-out.
valuePolicyRef | reference ObjectReferenceType | [0,1] | Reference to the value policy for the credential.
historyLength | property int | [0,1] | The number of entries to keep in the credential history.
historyStorageMethod | container CredentialsStorageMethodType | [0,1] | Method used to store historical values of the credential (encrypted, hashed, .
questionNumber | property int | [0,1] | Number of Questions in order to change the passwords
question | container SecurityQuestionDefinitionType | [0,-1] | The set of all the security questions in this policy.

- ### Items

  - #### storageMethod

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Method used to store the values of this credential (encrypted, hashed, ...) If storage method is not specified it defaults to encryption (due to compatibility and convenience reasons).

  - #### resetMethod

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Specifies the method of resetting the credential. This usually applies to a self-service credential reset.

  - #### propagationUserControl

    Flags: RAM,runtime,AVals:2

    Multiplicity: [0,1]

    Constraints that define how propagation of the credentials can be controlled by the user. E.g. if user can choose where the password change will be propagated.

  - #### minOccurs

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Minimal number of value occurrences. minOccurs set to zero means that the value is optional. E.g. when applied to passwords the minOccurs=0 means that the policy will accept no password at all. But it will still validate the password using stringPolicy if a password is present.

  - #### maxOccurs

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Maximal number of value occurrences. If not specified then the default schema limitation is imposed.

  - #### maxAge

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Maximum age of the credential, counted from the last credential value update. The credential must not be used after the age is exceeded (it is expired). Any authentication with such credential must fail.

  - #### minAge

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Minimum age of the credential, counted from the last credential value update. The credential cannot be changed before its minimal age is reached.

  - #### warningBeforeExpirationDuration

    Flags: RAM,runtime

    Multiplicity: [0,1]

    The time interval before credential expiration (exceeded maxAge) that the user will be warned that the credential is about to expire.

  - #### lockoutMaxFailedAttempts

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Maximum number of failed authentication attempts that can be tried before the credential is locked-out.

  - #### lockoutFailedAttemptsDuration

    Flags: RAM,runtime

    Multiplicity: [0,1]

    The duration in which the failed attempts must happen for the credential to be locked-out. The failed attempt counter is re-set after this duration (counted from the last failed attempt). The credential is NOT locked-out during this duration.

  - #### lockoutDuration

    Flags: RAM,runtime

    Multiplicity: [0,1]

    The duration for which the credential remains locked-out. The credential is automatically unlocked after this duration.

  - #### valuePolicyRef

    Flags: RAM

    Multiplicity: [0,1]

    Reference to the value policy for the credential.

  - #### historyLength

    Flags: RAM,runtime

    Multiplicity: [0,1]

    The number of entries to keep in the credential history. Also specifies the number of past credential values that will be checked before accepting a new credential change.

  - #### historyStorageMethod

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Method used to store historical values of the credential (encrypted, hashed, ...) If storage type is not specified then it defaults to hashing.

  - #### questionNumber

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Number of Questions in order to change the passwords

  - #### question

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    The set of all the security questions in this policy.