Password Best Practices for LDAP and SSO Users
For installations that run on LDAP or SSO authentication servers, it is recommended that at least one Site Administrator account be associated with LabKey's internal database authenticator as a failsafe. This will help prevent a situation where all users and administrators become locked out of the server should the external LDAP or SSO system fail or change unexpectedly. If there is a failure of the external authentication system, a Site Administrator can sign in using the failsafe database account and create new database authenticated passwords for the remaining administrators and users, until the external system is restored.
To create a failsafe database-based password:
- Click your login badge (= your user name displayed as a link) in the far upper right.
- Click Create Password. (This will create a failsafe password in the database.)
- Enter your password and click Set Password.
After setting up a failsafe password in the database, LabKey Server will continue to authenticate against the external LDAP or SSO system, but it will attempt to authenticate using database authentication if authentication using the external authentication system fails.
Password Rules
User passwords can be set to either "weak" or "strong" rules.
Weak rules require only that the password
- Must be more than 6 characters long.
- Must not match the user's email address.
Strong rules require that passwords meet the following criteria:
- Must be eight or more characters long.
- Must contain characters from at least three of the following character types:
- lowercase letter (a-z)
- uppercase letter (A-Z)
- digit (0-9)
- symbol (! @ # $ % & / < > = ?)
- Must not contain a sequence matching three or more characters from the user's email, address, display name, first name or last name.
- Must not match any of the user's 10 previous passwords.
Password Expiration
Administrators can also set the password expiration interval. Available expiration intervals are:
- Never
- Three months
- Six months
- Twelve months
Note: these password configuration options only apply to user accounts authenticated against the LabKey authentication database. The configuration settings chosen here do not effect the configuration of external authentication systems, such as LDAP and CAS single sign on.
