Password Composition Rules for the Password Validation Provider

Configuring Authentication Providers 5-23

5.8 Configuring the Password Validation Provider

WebLogic Server includes a Password Validation provider, which is configured by default in each security realm. The Password Validation provider manages and enforces a set of configurable password composition rules, and is automatically invoked by a supported authentication provider whenever a password is created or updated for a user in the realm. When invoked, the Password Validation provider performs a check to determine whether the password meets the criteria established by the composition rules. The password is then accepted or rejected as appropriate. The following authentication providers can be used with the Password Validation provider: ■ WebLogic Authentication provider ■ SQL Authenticator provider ■ LDAP Authentication provider ■ Oracle Internet Directory Authentication Provider ■ Oracle Virtual Directory Authentication Provider ■ Active Directory Authentication provider ■ iPlanet Authentication provider ■ Novell Authentication provider ■ Open LDAP Authentication provider The following sections describe the composition rules that may be configured and explain how to create and configure an instance of the Password Validation provider in a security realm: ■ Section 5.8.1, Password Composition Rules for the Password Validation Provider ■ Section 5.8.2, Using the Password Validation Provider with the WebLogic Authentication Provider ■ Section 5.8.3, Using the Password Validation Provider with an LDAP Authentication Provider ■ Section 5.8.4, Using WLST to Create and Configure the Password Validation Provider For information about configuring the Password Validation provider in the WebLogic Server Administration Console, see Configure the Password Validation provider in the Oracle WebLogic Server Administration Console Help.

5.8.1 Password Composition Rules for the Password Validation Provider

By default, the Password Validation provider is configured to require passwords that have a minimum length of eight characters. When used with one of the supported LDAP authentication providers listed in the preceding section, the Password Validation provider also requires that passwords meet the additional criteria listed in Table 5–9 . 5-24 Securing Oracle WebLogic Server The password composition rules you optionally can configure for the Password Validation provider include the following: ■ User name policies — Rules that determine whether the password may consist of or contain the users name, or the reverse of that name ■ Password length policies — Rules for the minimum or maximum number of characters in a password composition rules may specify both a minimum and maximum length ■ Character policies — Rules regarding the inclusion of the following characters in the password: – Numeric characters – Lowercase alphabetic characters – Uppercase alphabetic characters – Non-alphanumeric characters For information about the specific composition rules that may be configured for the Password Validation provider, including the settings for these rules that Oracle recommends for a production environment, see System Password Validation Provider: Provider Specific in the Oracle WebLogic Server Administration Console Help. Table 5–9 Additional Password Composition Rules Required by Password Validation Provider When Used with an LDAP Authentication Provider LDAP Authentication Provider Additional Password Composition Requirement ■ Oracle Internet Directory Authentication provider ■ Oracle Virtual Directory Authentication provider At least one of the characters in the password must be numeric. ■ WebLogic Authentication provider ■ LDAP Authentication provider ■ Active Directory Authentication provider ■ iPlanet Authentication provider ■ Novell Authentication provider ■ Open LDAP Authentication provider At least one of the characters in the password must be non-alphabetic. For example, a numeric character, an asterisk , or an octothorpe . Caution: Setting password composition rules is only one component of hardening the WebLogic Server environment against brute-force password attacks. To protect user accounts, you should also configure user lockout. User lockout specifies the number of incorrect passwords that may be entered within a given interval of time before the user is locked out of his or her account. For more information, see Section 13.7, Protecting User Accounts. Configuring Authentication Providers 5-25

5.8.2 Using the Password Validation Provider with the WebLogic Authentication Provider