# PasswordCredentialsPolicyType (Complex Type)

### Namespace: http://midpoint.evolveum.com/xml/ns/public/common/common-3

Supertype: CredentialPolicyType

Structure that specifies policy for password management. It is in fact only a simple reference to a password policy.

This is a credential policy. Which means that it controls how credentials are set (stored). It does not control how credentials are used for authentication. That is controlled by the authentication module setting - and in fact this may even be out of our control completely, e.g. in case that external authentication is used (SSO).

Item Summary
Name | Type | Multiplicity | Description
--- | --- | --- | ---
name | property string | [0,1] | Unique name of the credential.
description | property string | [0,1] | Free form description of the credential (administrator comment).
documentation | property string | [0,1] | Technical documentation for a particular object or construct.
storageMethod | container CredentialsStorageMethodType | [0,1] | Method used to store the values of this credential (encrypted, hashed, .
resetMethod | container CredentialsResetMethodType | [0,1] | Specifies the method of resetting the credential.
propagationUserControl | property CredentialsPropagationUserControlType | [0,1] | Constraints that define how propagation of the credentials can be controlled by the user.
minOccurs | property string | [0,1] | Minimal number of value occurrences.
maxOccurs | property string | [0,1] | Maximal number of value occurrences.
maxAge | property duration | [0,1] | Maximum age of the credential, counted from the last credential value update.
minAge | property duration | [0,1] | Minimum age of the credential, counted from the last credential value update.
warningBeforeExpirationDuration | property duration | [0,1] | The time interval before credential expiration (exceeded maxAge) that the user will be warned that the credential is about to expire.
lockoutMaxFailedAttempts | property int | [0,1] | Maximum number of failed authentication attempts that can be tried before the credential is locked-out.
lockoutFailedAttemptsDuration | property duration | [0,1] | The duration in which the failed attempts must happen for the credential to be locked-out.
lockoutDuration | property duration | [0,1] | The duration for which the credential remains locked-out.
valuePolicyRef | reference ObjectReferenceType | [0,1] | Reference to the value policy for the credential.
historyLength | property int | [0,1] | The number of entries to keep in the credential history.
historyStorageMethod | container CredentialsStorageMethodType | [0,1] | Method used to store historical values of the credential (encrypted, hashed, .
historyAllowExistingPasswordReuse | property boolean | [0,1] | If set to true, then existing focus password (last set password) can be reused and set again to the same value as the new password.
passwordChangeSecurity | property PasswordChangeSecurityType | [0,1] | Additional security applied when changing a password.
passwordHintConfigurability | property PasswordHintConfigurabilityType | [0,1] | Additional configurability applied when changing or resetting a password.

- ### Items

  - #### name

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Unique name of the credential. This name is fact a short identifier. It is supposed to give some idea about purpose of the credential to system administrator. It is also used for referencing the credential when needed (e.g. from authentication modules, credential reset specs, etc.) The name may be stored in the user object together with the credential. But it is not supposed to be used as a user-friendly label for credential. Credential name must be unique.

    Credential name is optional, mostly due to historical/compatibility reasons.

    This is a credential policy. Which means that it controls how credentials are set (stored). It does not control how credentials are used for authentication. That is controlled by the authentication module setting - and in fact this may even be out of our control completely, e.g. in case that external authentication is used (SSO).

  - #### description

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Free form description of the credential (administrator comment).

  - #### documentation

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Technical documentation for a particular object or construct.

    The purpose of this element is to document system configuration and behavior. The documentation will not be presented to end users. In fact, it will probably not be presented at all in midPoint user interface. This documentation element is supposed to be a part of the technical documentation of midPoint deployment. The tools than generate deployment configuration will look for these elements and combine them to compiled documentation document.

    AsciiDoc formatting is assumed for this element. Any leading or trailing whitespace is skipped. Indentation equivalent to he indentation of the first non-blank line of text is also skipped.

  - #### storageMethod

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Method used to store the values of this credential (encrypted, hashed, ...) If storage method is not specified it defaults to encryption (due to compatibility and convenience reasons).

  - #### resetMethod

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Specifies the method of resetting the credential. This usually applies to a self-service credential reset.

  - #### propagationUserControl

    Flags: RAM,runtime,AVals:4

    Multiplicity: [0,1]

    Constraints that define how propagation of the credentials can be controlled by the user. E.g. if user can choose where the password change will be propagated.

  - #### minOccurs

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Minimal number of value occurrences. minOccurs set to zero means that the value is optional. E.g. when applied to passwords the minOccurs=0 means that the policy will accept no password at all. But it will still validate the password using stringPolicy if a password is present.

  - #### maxOccurs

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Maximal number of value occurrences. If not specified then the default schema limitation is imposed.

  - #### maxAge

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Maximum age of the credential, counted from the last credential value update. The credential must not be used after the age is exceeded (it is expired). Any authentication with such credential must fail.

  - #### minAge

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Minimum age of the credential, counted from the last credential value update. The credential cannot be changed before its minimal age is reached.

  - #### warningBeforeExpirationDuration

    Flags: RAM,runtime

    Multiplicity: [0,1]

    The time interval before credential expiration (exceeded maxAge) that the user will be warned that the credential is about to expire.

  - #### lockoutMaxFailedAttempts

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Maximum number of failed authentication attempts that can be tried before the credential is locked-out.

  - #### lockoutFailedAttemptsDuration

    Flags: RAM,runtime

    Multiplicity: [0,1]

    The duration in which the failed attempts must happen for the credential to be locked-out. The failed attempt counter is re-set after this duration (counted from the last failed attempt). The credential is NOT locked-out during this duration.

  - #### lockoutDuration

    Flags: RAM,runtime

    Multiplicity: [0,1]

    The duration for which the credential remains locked-out. The credential is automatically unlocked after this duration.

  - #### valuePolicyRef

    Flags: RAM

    Multiplicity: [0,1]

    Reference to the value policy for the credential.

  - #### historyLength

    Flags: RAM,runtime

    Multiplicity: [0,1]

    The number of entries to keep in the credential history. Also specifies the number of past credential values that will be checked before accepting a new credential change.

  - #### historyStorageMethod

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Method used to store historical values of the credential (encrypted, hashed, ...) If storage type is not specified then it defaults to hashing.

  - #### historyAllowExistingPasswordReuse

    Flags: RAM,runtime

    Multiplicity: [0,1]

    If set to true, then existing focus password (last set password) can be reused and set again to the same value as the new password. However, when maxAge constraint is set, value cannot be reused after existing password has expired. If set to false, user must always provide fresh password when setting the new password. This setting is effective only when historyLength > 0. Default behaviour is that reuse is not allowed (setting is false).

  - #### passwordChangeSecurity

    Flags: RAM,runtime,AVals:3

    Multiplicity: [0,1]

    Additional security applied when changing a password. This applies when user is changing his own password. It does NOT apply when administrator changes password of other user.

  - #### passwordHintConfigurability

    Flags: RAM,runtime,AVals:2

    Multiplicity: [0,1]

    Additional configurability applied when changing or resetting a password. This applies when user is changing or resetting his own password. It does NOT apply when administrator changes password of other user.