Advanced Login Security

Advanced Login Security is an additional, optional feature that provides tighter controls for system access than the Base Security settings that are provided as a standard product feature. Advanced Login Security also provides reports listing historical records of successful and unsuccessful login attempts and changes to user profiles.

Base Security Settings

• Password Minimum Length – This value sets the minimum number of characters required in a password.
• Password Requirements – Select a value to enforce any of the following password requirements:
  • None – No password requirements are enforced.
  • Alpha – Passwords must contain at least one alphabetical character, for example abcd.
  • Alpha Numeric – Passwords must contain at least one alphabetical character and at least one numeric character or symbol, for example, abc123 or x!y!z.
  • Advanced – Passwords must contain at least one alpha character, one numeric character, and one special character, and the User ID cannot be in the password, for example, abc123x!y!z!
• Password Expiration Days – This value sets the number of days that it takes from the last password change for users' passwords to expire. If set to 0, passwords never expire. For example, if a user's password was set on 1/1/2010, setting this value to 45 would cause that user's password to expire on 2/15/2010. When the users sign in for the first time after the expiration date, they will not be locked out of the system, but they will have to go through the password change process. For installations using SAML/SSO, this value must be set 0.

Advanced Login Security Settings

The following features are added to the Base Security settings if Advanced Login Security is enabled.

• Min Password Repeat – This value sets the number of previous passwords that cannot be reused. For example, if this value is set to 3, then when users change their passwords, they cannot reuse any of their previous three passwords.
• Max Consecutive Login Attempts – This value sets maximum number of failed login attempts that are allowed before a user's account is locked. If a user's account becomes locked, it can be unlocked by a system administrator who has Login Admin security rights.
• Number of Hours to Freeze Password – This value establishes the number of hours that user must wait before making anther password change once he has successfully changed his password.
• Customized Password Error Text – These values can be used to specify the messages displayed to users when their accounts become locked (due to entering an invalid password) or when they are forced to change their passwords. Since screen sizes can vary greatly on standard and mobile devices, different values can be specified for each.
• Password Locked Error Text – This value specifies a custom message to display to users when their accounts become locked. If no value is specified, the following message is displayed: "ALERT: Your login has expired or been locked due to incorrect logins. Contact your system administrator."
• Force Password Change Text – This value specifies a custom message to display to users when they are required to change their passwords. If no value is specified, the following message is displayed: "ALERT: You are required to change your password prior to logging in."

Note:

The User Login Information report displays login information for specific users and includes a full audit trail of login history, password changes, and failed login attempts. For more information, see User Login Information Report.