---
title: "Configuring Passwords"
canonical: "https://docs.rubiconwater.com/space/UMNC/1985085508/Configuring%20Passwords"
format: markdown
---
> Macro (toc)

The password *requirements* field uses a regular expression to specify the number and type of characters that should be used in a password. The password *strength* field shows whether a password can contain repeated blocks of characters, or sequences of characters that might be easy to guess.

You must choose a strength setting appropriate for the password requirement setting.

# Password Requirements

The following built-in options are available as password requirements. You must choose one of these options:

| **Property** | **Description** |
| --- | --- |
| PIN | Exactly four digits. Note that this setting is available for backward compatibility with existing systems, but it is not recommended. |
| Regular strength alphanumeric | Between 7 and 12 characters. These can include letters, digits and underscores. They may not include spaces or punctuation. |
| Strong alphanumeric | Between 8 and 16 characters. These can include letters, digits and punctuation marks.<br>They MUST include:<br>- At least one lower case letter
- At least one upper case letter
- At least one digit |

## What is a *Custom* requirement?

A custom requirement uses one of the built-in requirement expressions, but has a customised description. If you choose a built-in requirement and edit the **Requirements Description**, the **Requirements** setting will change to *Custom*.

A custom requirement does **NOT** have a custom requirements expression. You cannot create your own requirements expressions. If you need a different password expression, please contact Rubicon Support.

# Password Strength

Password strength is determined using a standard calculation that takes into account predictable patterns in passwords such as repeated characters (for example "aaa") or sequences of consecutive characters (for example "abc"). See the [Password Meter](http://www.passwordmeter.com/) website for an interactive password strength testing tool.

> ℹ️ **Note**
> ℹ️ 
> ℹ️ Results of the Password Meter tests may differ slightly from the test applied by Rubicon.

Set the password strength to prevent users from choosing a password that is too simple. When a user chooses a new password, the strength is displayed beside the password field as a guide.

> ℹ️ **Caution**
> ℹ️ 
> ℹ️ *The password strength calculation is independent of the requirements expression that you have chosen and could potentially cause a conflict.*
> ℹ️ 
> ℹ️ Make sure that you do not set a minimum strength that is too high for the type of password you are using. For example, if you choose a simple password pattern, such as a four digit PIN, it is not possible to choose a password that is stronger than 10%. If you set the required strength higher than this, it will be impossible for users to choose an acceptable password.

# Other Password Restrictions

> ℹ️ **Caution**
> ℹ️ 
> ℹ️ If you select these additional restrictions, be sure to create a custom requirements description to make customers aware of your password policies. Otherwise, they may be confused when creating new passwords.

You can set properties of the authentication group to place further restrictions on passwords. See <u>[Configuring Authentication Group Settings](https://rubiconwater.atlassian.net/wiki/spaces/UMNC/pages/1985118249)</u> for a list of configuration options. Typical options include the following:

## Password Re-Use

Prevent users from re-using recent passwords by setting the **Reuse Limit**. 

> ℹ️ **Example**
> ℹ️ 
> ℹ️ If this is set to *3*, a user may not re-use any of their previous three passwords as their new password.

## Personal Details

Prevent users from using personal details such as their name as a password by setting the **Party Details Check**. If this option is selected, passwords may not contain any words of more than one character from these fields. (Note that a 'word' in this context is a group of characters separated by punctuation or white space and is not case sensitive.)

The fields checked are:

- Username
- Surname
- Given name
- Preferred name
- Address
- Pager phone number (such as mobile number)
- Phone number
- Customer number
- User number

> ℹ️ **Examples**
> ℹ️ 
> ℹ️ - If your name was "Joe B Bloggs", you could not use "JOE" or "bloggs" in your password but you could use “B”.
> ℹ️ - If your phone number was "12-345-6789" you could not use 12, 345 or 6789


---