Configure passwords

Password configuration options

In Abiquo, you can enforce your password best practice to improve user password security and usability. And you can allow users to reset their passwords.

The password options can:

• Prevent users from changing between a set of common passwords

• Ensure that users change their passwords periodically

• Prevent users from quickly reverting to an old password

• Require a minimum password length

• Require complex passwords that do not contain the users name and include at least three of the following five categories: uppercase letters, lowercase letters, digits, non-alphanumeric characters and other unicode characters.

• Email to remind users to change their password on a set of days before the expiry date

Configure password reset

With these options you can:

• Deter multiple attempts to break into a user account

• Allow users to reset their passwords and provide the URI for password reset.

Configure reCAPTCHA

For password recovery, you can enable reCAPTCHA V2 by adding reCAPTCHA keys to Abiquo. Request the keys from this link: https://www.google.com/recaptcha/admin#createsite

Set the public key in the Abiquo UI, in the client-config-custom.json file:

Set the private key on the Abiquo server, in the abiquo.properties file:

If only one key is present and the other key is missing, the user will receive an error message, and they cannot recover their password.

Configure password reset and expiration emails

You can configure Abiquo to send emails:

1. For users to reset their password after they click on the Forgot your password? link

2. On a set of days before password expiry, to remind them to change their password

See Configure custom platform messages

Configure password reset link

Users can reset their password in the UI by clicking on the Forgot your password? link.

Open

The Forgot your password link in the UI

You can configure the link address in the Configuration View, but if you do not wish to allow the user to reset their password, you should edit the client-config-custom.json file and set the client password recovery property to false.

When this value is false, the link will not display.

When it is true, the default password reset link will open the following dialog.

Open

Enter your username to receive a mail to change your password

Password UI configuration

Set up passwords in Configuration view on the Security page: 

Click Edit to see more information about the range of values and the default. 

For more details, see Configuration view#Security

Create a user

When you create a user, on the Advanced tab you can select an option to ensure they reset their password on login.

Locked users

A user that is locked out for too many failed login attempts is marked as Suspended in Users view in both the list view and the card view.

The administrator can edit the user and manually activate the account, or the user can wait for the lockout period to end. 

API

In the LoginResource, see:

• https://wiki.abiquo.com/api/latest/LoginResource.html#request-authorization-token-to-reset-user-password

• https://wiki.abiquo.com/api/latest/LoginResource.html#reset-user-password

Password events

The Abiquo events related to passwords can be found in the  Users section of the Events table.