RapidIdentity Product Guides - 2019 Rolling Release

The Restricted Passwords tab allows administrators to prevent certain words and values within a user's password. Administrators can blacklist passwords by:

Administrators have the option to require Case Sensitive Value Matching and Full Matches Only. More information on password configuration is available in Password Blacklist Standards.Password Blacklist Standards

Blacklisting Passwords by Text

Use this field to enter specific password values that should not be allowed.

The plus button adds entries while the delete button removes entries.

Adding a Blacklisted Value entry of AUTO, produces the following results:

If Full Matches Only is enabled

If Full Matches Only is disabled

Blacklisting Passwords by Regular Expression

RapidIdentity Portal can support any regular expression pattern that Java can accommodate. The regular expression must match the entire password, including the values that make it eligible for blacklisting.

For example, [^  ] allow administrators to negate (blacklist) any character following the carat symbol. For example, entering .*[^at].* allows any password that does not contain lower case "a" and "t". The .* in this expression means any character zero or more times.

Another example is excluding (blacklisting) any password containing a particular set of characters such as tabs, commas, and spaces with .*[\t, ].*.

Exclude Passwords that match these attributes values

The functionality on this tab is exactly the same as Blacklisted Passwords by Text but takes attribute directory values as input. This allows for the prevention of passwords that contain values such as the user's name or ID.

Adding a Blacklisted Value entry of GIVEN_NAME, and my name is James, produces the following results:

If Full Matches Only is enabled

If Full Matches Only is disabled