OTN Home > Oracle WebLogic Server 12.2.1.4.0 Documentation > Administration Console Online Help > Configure the Password Validation provider

Administration Console Online Help

Previous Next Open TOC in new window
Content starts here

Configure the Password Validation provider

Before you begin

If automatic realm restart is enabled, you do not need to restart WebLogic Server after activating non-dynamic changes to security providers. See Enable automatic realm restart and Using Automatic Realm Restart.


When configured in a security realm, the Password Validation provider is automatically invoked by a supported authentication provider whenever a password is created or updated for a user in that realm. The Password Validation provider then performs a check to determine whether the password meets the criteria established by the composition rules, and the password is accepted or rejected as appropriate.

The password composition rules you can configure for the Password Validation provider include the following:

  • User name policies, such as whether the password can be the same as the username.
  • Password length policies, such as a minimum or maximum length.
  • Character policies, such as the minimum or maximum number of alphabetic, numeric, or non-alphanumeric characters required in each password.

Note: Passwords cannot contain a curly brace ("{") as the first character.

Note: By default, the Default Authentication provider requires a minimum password length of 8 characters. However, the minimum password length enforced by the Default Authentication provider can be customized. In either case, if the Default Authentication provider and Password Validation provider are both configured in the security realm, and you attempt to create a password that does not meet the minimum length enforced by the Default Authentication provider, an error is generated.

For complete details about each rule you can configure with the Password Validation provider, see Configuration Options.

To configure the Password Validation provider:

  1. If you have not already done so, in the Change Center of the Administration Console, click Lock & Edit (see Use the Change Center).
  2. In the left pane, select Security Realms and click the name of the realm you are configuring (for example, myrealm).
  3. Select Providers > Password Validation.

    The Password Validation Providers table lists the Password Validation providers configured in this security realm.
  4. Click New.

    The Create a New Password Validation Provider page appears.
  5. In the Name field, enter a name for the Password Validation provider.
  6. From the Type drop-down list, select the type of the Password Validation provider and click OK.
  7. Select Providers > Password Validation and click the name of the new Password Validation provider to complete its configuration.
  8. Under Configuration > Provider Specific, set the username, password length, and character policies you wish to set for the new Password Validation provider.
  9. Click Save to save your changes.
  10. In the Change Center, click Activate Changes. If automatic realm restart is enabled, you do not need to restart WebLogic Server for updates to take effect.

Back to Top