Supported password validators

The names of the other attributes to check when validating the password. If this is not provided, then all attributes are used by default.

Indicates whether to reject passwords that are a substring of the value of another attribute in the user’s entry. By default, only exact matches are rejected.

Indicates whether to reject passwords that contain the value of another attribute in the user’s entry as a substring. By default, only exact matches are rejected.

An integer value that specifies the minimum attribute value length that will be checked if test-attribute-value-substring-of-password is set to true. This can help prevent inappropriately rejecting passwords that happen to contain short attribute values. For example, if you have an attribute whose values can be just a single character, you probably don’t want to prevent passwords that happen to contain that character. By default, only attributes values that contain at least four characters are checked.

Indicates whether to check attribute values in reverse order in addition to the order in which the values are stored. For example, if an attribute has value of “jdoe”, then this could cause the server to also check for a value of “eodj”. This is true by default.

Defines the sets of characters that are validated. Each of these sets should be defined as an integer followed by a colon and the characters contained in that set. The integer defines the minimum number of characters from that set that must be present in passwords. For example, a character-set value of “1:abcdefghijklmnopqrstuvwxyz” indicates that passwords will be required to have at least one lowercase letter. The integer value can be zero to indicate that characters from that set are permitted to be included in passwords but are not required. By default, the validator is configured with sets containing all lowercase letters, all uppercase letters, all numeric digits, and a range of ASCII symbols, and to require passwords to contain at least one character from each of those sets.

Indicates whether to allow passwords to contain characters that are not contained in any of the defined character sets. This is true by default.

Specifies the minimum number of character sets that are required to be included in passwords. This is useful, for example, if you want to require passwords to contain characters from at least three of the four predefined sets of lowercase letters, uppercase letters, digits, and symbols. In this case, all of the character sets should be updated to have a minimum required count (the value before the colon) of zero to indicate that they are all optional. If any character set has a nonzero minimum required count, then at least that many characters from that set are required in passwords, even if they would otherwise have contained characters from enough of the other sets.

The path to a file containing the list of prohibited passwords. Each line of the file represents a prohibited password.

Indicates whether differences in capitalization should not be ignored when checking passwords against the dictionary file. By default, the validator uses case-insensitive validation.

Indicates whether to test passwords in reversed order when checking them against the dictionary file. For example, to prohibit a password of “terces” if the dictionary contains the word “secret”. Reversed passwords are not checked by default.

Indicates whether to ignore any non-alphabetic characters that might appear at the start of the password when checking passwords against the dictionary file. For example, “123secret” could be rejected if the dictionary contains the word “secret”. By default, all leading characters are considered significant.

Indicates whether to ignore any non-alphabetic characters that might appear at the end of the password when checking passwords against the dictionary file. For example “secret123” could be rejected if the dictionary contains the word “secret”. By default, all trailing characters are considered significant.

Indicates whether to strip diacritical marks, such as accents, cedillas, circumflexes, diaereses, tildes, and umlauts, off of characters before checking passwords against the dictionary. For example, “sèçréť” could be rejected if the dictionary contains the word “secret”. By default, diacritical marks are preserved.

Specifies a set of alternative characters that might be substituted in when checking passwords against a dictionary. For example, if a dollar sign is a substitute for the letter s, the number 3 is a substitute for the letter e, and the number 7 is a substitute for the letter t, then “$3cr37” could be rejected if the dictionary contains the word “secret”. By default, no character substitutions are defined.

Indicates that the proposed password should be rejected if it makes up at least a given percentage of a dictionary word . For example, if this threshold is set to 70%, then “mysecret” could be rejected if the dictionary contains the word “secret” because the word “secret” makes up 75% of “mysecret”. By default, this is set to 100%, so values are ony rejected if they match complete dictionary words (after performing any other configured processing, like stripping of leading or trailing non-alphabetic characters).

The assumed rate at which an attacker can make password guessing attempts. By default, the validator assumes a rate of one hundred billion guesses per second.

The minimum acceptable length of time required to try all possible combinations of characters in the sets that make up the proposed password at the configured maximum rate. By default, the minimum acceptable time is one week.

The minimum number of characters that passwords are allowed to contain. Passwords that contain fewer characters than this limit are rejected.

The maximum number of characters that passwords are allowed to contain. Passwords that contain more characters than this limit are rejected. A value of zero indicates that no limit is enforced.

The base URL to use for the service with which to communicate. By default, this is https://api.pwnedpasswords.com/range/.

Indicates whether the validator should be invoked for passwords set in add requests. Thisis true by default.

Indicates whether the validator should be invoked for new passwords chosen by the end user. This is true by default.

Indicates whether the validator should be invoked for new passwords set by an administrator. This is true by default.

Indicates whether the validator should consider the password acceptable if it cannot communicate with the target service, or if that service returns an error response. By default, the password is considered acceptable although it might still be rejected if it fails to satisfy one or more of the other configured validators.

A key manager provider that should be used for HTTPS communication with the target service. This can be omitted, which is the case by default, if no key store is required because the client does not need to present its own client certificate chain to the server.

A trust manager that should be used for HTTPS communication to determine whether to trust the server’s certificate chain. This can be omitted if the server should use the JVM’s default trust store.

The regular expression pattern to use when evaluating proposed passwords.

The behavior to exhibit if the given pattern matches a proposed password. Allowed values include:

The maximum number of times that the character is allowed to be present consecutively within a proposed password. The default value is 2, which means that it is acceptable for the same character to appear twice in a row, but not three times or more.

Indicates whether to treat uppercase and lowercase versions of the same letter as different. By default, the validator uses case-insensitive validation, which means that it would reject a password containing the string “aAa” if the validator is configured with a max-consecutive-length of 2.

An optional set of characters that should be considered equivalent for the purpose of this password validator. For example, you could use this to define a set of numeric digits, and then reject passwords that contain too many consecutive digits.

The minimum number of changes (character insertions, removals, or replacements) required to convert the user’s current password into the proposed new password for that new password to be considered acceptable. The default value is 3.

The minimum number of different characters that can appear in an acceptable password. Passwords that contain fewer than this number of unique characters are rejected.

Indicates whether to perform case-sensitive validation, in which uppercase and lowercase versions of the same letter are treated as different characters. By default, the validator uses case-insensitive validation.