Designing Password Policies

A password policy is a set of rules that govern how passwords are administered in a system. Directory Server supports multiple password policies, as well as a default password policy.

Several elements of the password policy are configurable, enabling you to design a policy that suits the security requirements of your organization. Configuration of the password policy is described in Chapter 7, Directory Server Password Policy, in Oracle Directory Server Enterprise Edition Administration Guide. The individual attributes available for configuring password policies are described in the pwpolicy(5dssd) man page.

This section is divided into the following topics:

• Password policy options

• Password policies in a replicated environment

• Password policy migration

Password Policy Options

The following password policy options are provided:

• A default password policy is applied. The parameters of this default policy can be changed.

• An additional, specialized password policy can be applied to a particular user.

• An additional, specialized password policy can be applied to a set of users by using the CoS and Roles functionality. Password policies cannot be applied to static groups.

Password Policies in a Replicated Environment

Configuration information for the default password policy is not replicated. Instead, it is part of the server instance configuration. If you modify the default password policy, the same modifications must be made on each server in the topology. If you need a password policy that is replicated, you must define a specialized password policy under a part of the directory tree that is replicated.

All password information that is stored in the user entry is replicated. This information includes the current password, password history, password expiration dates and so forth.

Consider the following impact of password policies in a replicated environment:

• A user with an impending password expiration receives a warning from every replica to which the user binds before changing his password.

• When a user changes his password, the new password might take a while to be updated on all replicas. A situation could arise where a user changes his password and then immediately rebinds to one of the consumer replicas with the new password. In this case, the bind could fail until the replica receives the updated password. This situation can be alleviated using prioritized replication to force password changes to be replicated first.

Password Policy Migration

The Directory Server Enterprise Edition password policy configuration settings differ from the password policy configuration settings provided with the 5.2 version of Directory Server. If your topology includes servers that run different versions of Directory Server, see Password Policy in Oracle Directory Server Enterprise Edition Upgrade and Migration Guide for information about how to migrate password policy settings.