Request password policies

v1.0.0

🚀 Since v4.14.0

Description:

Retrieve a list of configured password policies for all password types:

login
shares
encryption

Precondition:

Right 🔓 read global config and role 👤 Config Manager of the Provider Customer required.

Postcondition:

List of configured password policies is returned.

Further Information:

None.

Available password policies:

Expand

Name	Description	Value	Password Type
`mustContainCharacters`	Characters which a password must contain: `alpha` - at least one alphabetical character (`uppercase` OR `lowercase`)a b c d e f g h i j k l m n o p q r s t u v w x y z A B C D E F G H I J K L M N O P Q R S T U V W X Y Z `uppercase` - at least one uppercase characterA B C D E F G H I J K L M N O P Q R S T U V W X Y Z `lowercase` - at least one lowercase charactera b c d e f g h i j k l m n o p q r s t u v w x y z `numeric` - at least one numeric character0 1 2 3 4 5 6 7 8 9 `special` - at least one special character (letters and digits excluded)! " # $ % ( ) * + , - . / : ; = ? @ [ \ ] ^ _ { \| } ~ `none` - none of the above	`alpha` `uppercase` `lowercase` `numeric` `special` `none`	`login` `shares` `encryption`
`numberOfCharacteristicsToEnforce`	Number of characteristics to enforce. e.g. from `["uppercase", "lowercase", "numeric", "special"]` all 4 character sets can be enforced; but also only 2 of them	`Integer between 0 and 4`	`login` `shares` `encryption`
`minLength`	Minimum number of characters a password must contain.	`Integer between 1 and 1024`	`login` `shares` `encryption`
`rejectDictionaryWords`	Determines whether a password must NOT contain word(s) from a dictionary. In `core-service.properties` a path to directory with dictionary files (`*.txt`) can be defined cf. `policies.passwords.dictionary.directory`. If this rule gets enabled `policies.passwords.dictionary.directory` must be defined and contain dictionary files. Otherwise, the rule will not have any effect on password validation process.	`true or false`	`login` `shares`
`rejectUserInfo`	Determines whether a password must NOT contain user info. Affects user's first name, last name, email and user name.	`true or false`	`login` `shares` `encryption`
`rejectKeyboardPatterns`	Determines whether a password must NOT contain keyboard patterns. e.g. `qwertz`, `asdf` (min. 4 character pattern)	`true or false`	`login` `shares` `encryption`
`numberOfArchivedPasswords`	Number of passwords to archive. Value `0` means that password history is disabled.	`Integer between 0 and 10`	`login`
`passwordExpiration.enabled`	Determines whether password expiration is enabled.	`true or false`	`login`
`maxPasswordAge`	Maximum allowed password age (in days)	`positive Integer`	`login`
`userLockout.enabled`	Determines whether user lockout is enabled.	`true or false`	`login`
`maxNumberOfLoginFailures`	Maximum allowed number of failed login attempts.	`positive Integer`	`login`
`lockoutPeriod`	Amount of minutes a user has to wait to make another login attempt after `maxNumberOfLoginFailures` has been exceeded.	`positive Integer`	`login`

Input

{
  "type": "object",
  "properties": {
    "X-Sds-Auth-Token": {
      "type": "string"
    }
  },
  "additionalProperties": false
}

Output

{
  "type": "object",
  "description": "Set of password policies",
  "properties": {
    "encryptionPasswordPolicies": {
      "type": "object",
      "description": "Encryption password policies",
      "properties": {
        "characterRules": {
          "type": "object",
          "description": "Password character rules",
          "required": [
            "mustContainCharacters",
            "numberOfCharacteristicsToEnforce"
          ],
          "properties": {
            "mustContainCharacters": {
              "type": "array",
              "description": "Characters which a password must contain:\n\n* `alpha` - at least one alphabetical character (`uppercase` OR `lowercase`)\n\n* `uppercase` - at least one uppercase character\n\n* `lowercase` - at least one lowercase character\n\n* `numeric` - at least one numeric character\n\n* `special` - at least one special character (letters and digits excluded)\n\n* `all` - combination of `uppercase`, `lowercase`, `numeric` and `special` (available only in request models)\n\n* `none` - none of the above",
              "enum": [
                "alpha",
                "uppercase",
                "lowercase",
                "numeric",
                "special",
                "all",
                "none"
              ],
              "items": {
                "type": "string",
                "description": "Characters which a password must contain:\n\n* `alpha` - at least one alphabetical character (`uppercase` OR `lowercase`)\n\n* `uppercase` - at least one uppercase character\n\n* `lowercase` - at least one lowercase character\n\n* `numeric` - at least one numeric character\n\n* `special` - at least one special character (letters and digits excluded)\n\n* `all` - combination of `uppercase`, `lowercase`, `numeric` and `special` (available only in request models)\n\n* `none` - none of the above",
                "enum": [
                  "alpha",
                  "uppercase",
                  "lowercase",
                  "numeric",
                  "special",
                  "all",
                  "none"
                ]
              }
            },
            "numberOfCharacteristicsToEnforce": {
              "type": "integer",
              "format": "int32",
              "description": "Number of characteristics to enforce\n\ne.g. from `[\"uppercase\", \"lowercase\", \"numeric\", \"special\"]`\n\nall 4 character sets can be enforced; but also only 2 of them"
            }
          }
        },
        "minLength": {
          "type": "integer",
          "format": "int32",
          "description": "Minimum number of characters a password must contain"
        },
        "rejectKeyboardPatterns": {
          "type": "boolean",
          "description": "Determines whether a password must NOT contain keyboard patterns (e.g. `qwertz`, `asdf`)\n\n(min. 4 character pattern)"
        },
        "rejectUserInfo": {
          "type": "boolean",
          "description": "Determines whether a password must NOT contain user info (first name, last name, email, user name)"
        },
        "updatedAt": {
          "type": "string",
          "format": "date-time",
          "description": "Modification date"
        },
        "updatedBy": {
          "type": "object",
          "description": "User information",
          "required": [
            "avatarUuid",
            "firstName",
            "id",
            "lastName",
            "userName",
            "userType"
          ],
          "properties": {
            "avatarUuid": {
              "type": "string",
              "description": "&#128640; Since v4.11.0\n\nAvatar UUID"
            },
            "displayName": {
              "type": "string",
              "description": "&#128679; Deprecated since v4.11.0\n\nDisplay name\n\nuse other fields from `UserInfo` instead to combine a display name"
            },
            "email": {
              "type": "string",
              "description": "&#128640; Since v4.11.0\n\nEmail "
            },
            "firstName": {
              "type": "string",
              "description": "&#128640; Since v4.11.0\n\nUser first name (mandatory if `userType` is `internal`)"
            },
            "id": {
              "type": "integer",
              "format": "int64",
              "description": "Unique identifier for the user"
            },
            "lastName": {
              "type": "string",
              "description": "&#128640; Since v4.11.0\n\nUser last name (mandatory if `userType` is `internal`)"
            },
            "title": {
              "type": "string",
              "description": "&#128679; Deprecated since v4.18.0\n\nJob title"
            },
            "userName": {
              "type": "string",
              "description": "&#128640; Since v4.13.0\n\nUsername (only returned for `internal` users)"
            },
            "userType": {
              "type": "string",
              "description": "&#128640; Since v4.11.0\n\nUser type:\n\n* `internal` - ordinary DRACOON user\n\n* `external` - external user without DRACOON account\n\n* `system` - system user (non human &#128125;)\n\n* `deleted` - deleted DRACOON user",
              "enum": [
                "system",
                "internal",
                "external",
                "deleted"
              ]
            }
          }
        }
      }
    },
    "loginPasswordPolicies": {
      "type": "object",
      "description": "Login password policies",
      "required": [
        "characterRules",
        "minLength",
        "numberOfArchivedPasswords",
        "passwordExpiration",
        "rejectDictionaryWords",
        "rejectKeyboardPatterns",
        "rejectUserInfo",
        "updatedAt",
        "updatedBy",
        "userLockout"
      ],
      "properties": {
        "characterRules": {
          "type": "object",
          "description": "Password character rules",
          "required": [
            "mustContainCharacters",
            "numberOfCharacteristicsToEnforce"
          ],
          "properties": {
            "mustContainCharacters": {
              "type": "array",
              "description": "Characters which a password must contain:\n\n* `alpha` - at least one alphabetical character (`uppercase` OR `lowercase`)\n\n* `uppercase` - at least one uppercase character\n\n* `lowercase` - at least one lowercase character\n\n* `numeric` - at least one numeric character\n\n* `special` - at least one special character (letters and digits excluded)\n\n* `all` - combination of `uppercase`, `lowercase`, `numeric` and `special` (available only in request models)\n\n* `none` - none of the above",
              "enum": [
                "alpha",
                "uppercase",
                "lowercase",
                "numeric",
                "special",
                "all",
                "none"
              ],
              "items": {
                "type": "string",
                "description": "Characters which a password must contain:\n\n* `alpha` - at least one alphabetical character (`uppercase` OR `lowercase`)\n\n* `uppercase` - at least one uppercase character\n\n* `lowercase` - at least one lowercase character\n\n* `numeric` - at least one numeric character\n\n* `special` - at least one special character (letters and digits excluded)\n\n* `all` - combination of `uppercase`, `lowercase`, `numeric` and `special` (available only in request models)\n\n* `none` - none of the above",
                "enum": [
                  "alpha",
                  "uppercase",
                  "lowercase",
                  "numeric",
                  "special",
                  "all",
                  "none"
                ]
              }
            },
            "numberOfCharacteristicsToEnforce": {
              "type": "integer",
              "format": "int32",
              "description": "Number of characteristics to enforce\n\ne.g. from `[\"uppercase\", \"lowercase\", \"numeric\", \"special\"]`\n\nall 4 character sets can be enforced; but also only 2 of them"
            }
          }
        },
        "minLength": {
          "type": "integer",
          "format": "int32",
          "description": "Minimum number of characters a password must contain"
        },
        "numberOfArchivedPasswords": {
          "type": "integer",
          "format": "int32",
          "description": "Number of passwords to archive\n\n(must be between `0` and `10`; `0` means that password history is disabled)"
        },
        "passwordExpiration": {
          "type": "object",
          "description": "Password expiration information",
          "required": [
            "enabled"
          ],
          "properties": {
            "enabled": {
              "type": "boolean",
              "description": "Determines whether password expiration is enabled"
            },
            "maxPasswordAge": {
              "type": "integer",
              "format": "int32",
              "description": "Maximum allowed password age (in days)"
            }
          }
        },
        "rejectDictionaryWords": {
          "type": "boolean",
          "description": "Determines whether a password must NOT contain word(s) from a dictionary"
        },
        "rejectKeyboardPatterns": {
          "type": "boolean",
          "description": "Determines whether a password must NOT contain keyboard patterns (e.g. `qwertz`, `asdf`)\n\n(min. 4 character pattern)"
        },
        "rejectUserInfo": {
          "type": "boolean",
          "description": "Determines whether a password must NOT contain user info (first name, last name, email, user name)"
        },
        "updatedAt": {
          "type": "string",
          "format": "date-time",
          "description": "Modification date"
        },
        "updatedBy": {
          "type": "object",
          "description": "User information",
          "required": [
            "avatarUuid",
            "firstName",
            "id",
            "lastName",
            "userName",
            "userType"
          ],
          "properties": {
            "avatarUuid": {
              "type": "string",
              "description": "&#128640; Since v4.11.0\n\nAvatar UUID"
            },
            "displayName": {
              "type": "string",
              "description": "&#128679; Deprecated since v4.11.0\n\nDisplay name\n\nuse other fields from `UserInfo` instead to combine a display name"
            },
            "email": {
              "type": "string",
              "description": "&#128640; Since v4.11.0\n\nEmail "
            },
            "firstName": {
              "type": "string",
              "description": "&#128640; Since v4.11.0\n\nUser first name (mandatory if `userType` is `internal`)"
            },
            "id": {
              "type": "integer",
              "format": "int64",
              "description": "Unique identifier for the user"
            },
            "lastName": {
              "type": "string",
              "description": "&#128640; Since v4.11.0\n\nUser last name (mandatory if `userType` is `internal`)"
            },
            "title": {
              "type": "string",
              "description": "&#128679; Deprecated since v4.18.0\n\nJob title"
            },
            "userName": {
              "type": "string",
              "description": "&#128640; Since v4.13.0\n\nUsername (only returned for `internal` users)"
            },
            "userType": {
              "type": "string",
              "description": "&#128640; Since v4.11.0\n\nUser type:\n\n* `internal` - ordinary DRACOON user\n\n* `external` - external user without DRACOON account\n\n* `system` - system user (non human &#128125;)\n\n* `deleted` - deleted DRACOON user",
              "enum": [
                "system",
                "internal",
                "external",
                "deleted"
              ]
            }
          }
        },
        "userLockout": {
          "type": "object",
          "description": "User lockout information",
          "required": [
            "enabled"
          ],
          "properties": {
            "enabled": {
              "type": "boolean",
              "description": "Determines whether user lockout is enabled"
            },
            "lockoutPeriod": {
              "type": "integer",
              "format": "int32",
              "description": "Amount of minutes a user has to wait to make another login attempt after `maxNumberOfLoginFailures` has been exceeded"
            },
            "maxNumberOfLoginFailures": {
              "type": "integer",
              "format": "int32",
              "description": "Maximum allowed number of failed login attempts"
            }
          }
        }
      }
    },
    "sharesPasswordPolicies": {
      "type": "object",
      "description": "Shares password policies",
      "properties": {
        "characterRules": {
          "type": "object",
          "description": "Password character rules",
          "required": [
            "mustContainCharacters",
            "numberOfCharacteristicsToEnforce"
          ],
          "properties": {
            "mustContainCharacters": {
              "type": "array",
              "description": "Characters which a password must contain:\n\n* `alpha` - at least one alphabetical character (`uppercase` OR `lowercase`)\n\n* `uppercase` - at least one uppercase character\n\n* `lowercase` - at least one lowercase character\n\n* `numeric` - at least one numeric character\n\n* `special` - at least one special character (letters and digits excluded)\n\n* `all` - combination of `uppercase`, `lowercase`, `numeric` and `special` (available only in request models)\n\n* `none` - none of the above",
              "enum": [
                "alpha",
                "uppercase",
                "lowercase",
                "numeric",
                "special",
                "all",
                "none"
              ],
              "items": {
                "type": "string",
                "description": "Characters which a password must contain:\n\n* `alpha` - at least one alphabetical character (`uppercase` OR `lowercase`)\n\n* `uppercase` - at least one uppercase character\n\n* `lowercase` - at least one lowercase character\n\n* `numeric` - at least one numeric character\n\n* `special` - at least one special character (letters and digits excluded)\n\n* `all` - combination of `uppercase`, `lowercase`, `numeric` and `special` (available only in request models)\n\n* `none` - none of the above",
                "enum": [
                  "alpha",
                  "uppercase",
                  "lowercase",
                  "numeric",
                  "special",
                  "all",
                  "none"
                ]
              }
            },
            "numberOfCharacteristicsToEnforce": {
              "type": "integer",
              "format": "int32",
              "description": "Number of characteristics to enforce\n\ne.g. from `[\"uppercase\", \"lowercase\", \"numeric\", \"special\"]`\n\nall 4 character sets can be enforced; but also only 2 of them"
            }
          }
        },
        "minLength": {
          "type": "integer",
          "format": "int32",
          "description": "Minimum number of characters a password must contain"
        },
        "rejectDictionaryWords": {
          "type": "boolean",
          "description": "Determines whether a password must NOT contain word(s) from a dictionary"
        },
        "rejectKeyboardPatterns": {
          "type": "boolean",
          "description": "Determines whether a password must NOT contain keyboard patterns (e.g. `qwertz`, `asdf`)\n\n(min. 4 character pattern)"
        },
        "rejectUserInfo": {
          "type": "boolean",
          "description": "Determines whether a password must NOT contain user info (first name, last name, email, user name)"
        },
        "updatedAt": {
          "type": "string",
          "format": "date-time",
          "description": "Modification date"
        },
        "updatedBy": {
          "type": "object",
          "description": "User information",
          "required": [
            "avatarUuid",
            "firstName",
            "id",
            "lastName",
            "userName",
            "userType"
          ],
          "properties": {
            "avatarUuid": {
              "type": "string",
              "description": "&#128640; Since v4.11.0\n\nAvatar UUID"
            },
            "displayName": {
              "type": "string",
              "description": "&#128679; Deprecated since v4.11.0\n\nDisplay name\n\nuse other fields from `UserInfo` instead to combine a display name"
            },
            "email": {
              "type": "string",
              "description": "&#128640; Since v4.11.0\n\nEmail "
            },
            "firstName": {
              "type": "string",
              "description": "&#128640; Since v4.11.0\n\nUser first name (mandatory if `userType` is `internal`)"
            },
            "id": {
              "type": "integer",
              "format": "int64",
              "description": "Unique identifier for the user"
            },
            "lastName": {
              "type": "string",
              "description": "&#128640; Since v4.11.0\n\nUser last name (mandatory if `userType` is `internal`)"
            },
            "title": {
              "type": "string",
              "description": "&#128679; Deprecated since v4.18.0\n\nJob title"
            },
            "userName": {
              "type": "string",
              "description": "&#128640; Since v4.13.0\n\nUsername (only returned for `internal` users)"
            },
            "userType": {
              "type": "string",
              "description": "&#128640; Since v4.11.0\n\nUser type:\n\n* `internal` - ordinary DRACOON user\n\n* `external` - external user without DRACOON account\n\n* `system` - system user (non human &#128125;)\n\n* `deleted` - deleted DRACOON user",
              "enum": [
                "system",
                "internal",
                "external",
                "deleted"
              ]
            }
          }
        }
      }
    }
  }
}