Tighter Validations on User Passwords

Last updated
Save as PDF

The following tighter validations were introduced in Services Portal Release 3.8 Patch 7 to the specified user web services in order to align ISO27001 and SOX security requirements.

Area Web Service(s) Description of Change

Password Complexity

createUser
editUser
setUserPassword

Existing error (Password invalid) will be returned if password doesn’t meet these complexity requirements:

Must be 8 - 35 characters for web users (those with UI access); 24 - 35 characters for integration-only users
Must have at least one upper-case and lower-case letter
Must have at least one number
Must have at least one special character (!@#$%&*()+=<>,./?':;-)

Password History

createUser
editUser
setUserPassword

Existing error (Password invalid) will be returned if the new password is the same as the last 24 passwords

Password Expiration

all

Exisiting error (User not authorized) will be returned if the password has expired or if the password reset required flag is true