Skip to Content (Press Enter)
Back to Ideas
24
Like
Follow Idea
Password policy settings
1577Views
16Comments
On our RadarOn our Radar
Service Center
In both ServiceCenter and Users
21 Feb 2012
Copy link to comment
Can you give an example what you would like regarding this subject?
22 Feb 2012
Copy link to comment
Normal policies:
- Don't allow passwords already used by the user (password history)
- Password maximum age
- Password minimum complexity and length
- Password lockage by attempted failed logins
23 Feb 2012
Copy link to comment
2015-05-05 17-20-51
João Santos
Hi,

You can use external authentication to have password policies for the users.
External authentication for Lifetime is coming soon.

Joao
09 Feb 2015
Copy link to comment
2023-02-10 19-42-59
João Melo
 
MVP
Just a hint, if you can't wait for an enhancement in future versions.. You could overwrite the Change Password Screens / Actions reusing, partially, the native OS logics and implementing your own.
11 Feb 2015
Copy link to comment
Hi Guys,

Any where I can set password complexity for Lifetime and Servicecenter?
22 May 2015
Copy link to comment
There are no built-in features for this.  As the previous posts state you must use an external authentication mechanism or write yur own logic for the password screens.  There are several Forge components that interface with external mechanisms such as LDAP.

Hope this helps,
Curt
29 May 2015
Copy link to comment
2016-04-21 20-09-55
J.
 
MVP
It's becoming a serious issue.

Even if you want to enforce a password-policy, there is no way to alter the change-password inside the Users-espace

10 Jun 2015
Copy link to comment

From the user eSpace itself this isn't possible, but you can write you own password logic and save this as the password for the user (by using the getForUpdate action from user entity with the encrypt() system function).
11 Jun 2015
Copy link to comment
2016-04-21 20-09-55
J.
 
MVP
@Evert, true, but you have to disable the Users-espace for that (one thing I didn't knew was possible)
12 Jun 2015
Copy link to comment
Hello Statler,

I thought it's also possible without setting it on disable? But maybe when users isn't the user provider eSpace?

Kind regards,
Evert
12 Jun 2015
Copy link to comment

I think this is a must have feature. Considering the fact that all high privileges accounts are being created either in service center or lifetime, there should be a password policy in place. I don't understand why there are no many votes on this idea, is everyone using an external directory ?  

25 Jul 2018
Copy link to comment

Yes, this needs to be available as part of OutSystem feature rather than relying on external authentication.

12 Nov 2018
Copy link to comment

I agree. This definitely should be implemented in the OutSystems Platform for IT Users.

Security wise this current password policy for IT Users is not sufficient at all in the current times where security on cloud environments are more and more important. I am surprised this has not been addressed yet in OutSystems Cloud environments.

13 Oct 2020
Copy link to comment
Merged this idea with 'OS Users & LT Users: password policy' (created on 30 Jun 2021 11:28:49 by William Vermeulen)
02 Jul 2021
Copy link to comment

The OutSystems users application and LT users adminstration allows for the creation of (IT) users. It would be great if you have additional parameters you can configure to define your access management. Thinking about:

  • password change policy
    • define password strengths, history, expiration etc
  • notifications; 
    • email about pwd expirations
    • possible compromises
  • de-activating policies
  • reset pwd policy
    • set expiration
  • Enable 2FA

Just some thought to make User management more secure when you don't use an IDP already in place.



This comment was:
- originally posted on idea 'OS Users & LT Users: password policy' (created on 30 Jun 2021 by William Vermeulen)
- merged to idea 'Password policy settings' on 02 Jul 2021 06:11:08 by Daniël Kuhlmann
30 Jun 2021
Copy link to comment

Suggest you look at my Application Framework, it supports almost all of these already, and is 10x more secure than Users is too.

It would be nice if OutSystems did these things by default, but until then, you have a solution, at least for application users.

Application Framework - Overview | OutSystems

J.Ja



This comment was:
- originally posted on idea 'OS Users & LT Users: password policy' (created on 30 Jun 2021 by William Vermeulen)
- merged to idea 'Password policy settings' on 02 Jul 2021 06:11:08 by Daniël Kuhlmann
01 Jul 2021
Copy link to comment