Configuring the Password Policy.
Authelia allows administrators to configure an enforced password policy.
password_policy: standard: enabled: false min_length: 8 max_length: 0 require_uppercase: false require_lowercase: false require_number: false require_special: false zxcvbn: enabled: false min_score: 3
This section describes the individual configuration options.
This section allows you to enable standard security policies.
Enables standard password policy.
Determines the minimum allowed password length.
Determines the maximum allowed password length.
Indicates that at least one UPPERCASE letter must be provided as part of the password.
Indicates that at least one lowercase letter must be provided as part of the password.
Indicates that at least one number must be provided as part of the password.
Indicates that at least one special character must be provided as part of the password.
This password policy enables advanced password strength metering, using zxcvbn.
Note that this password policy do not restrict the user’s entry it just gives the user feedback as to how strong their password is.
Important Note: only one password policy can be applied at a time.
Enables zxcvbn password policy.
Configures the minimum zxcvbn score allowed for new passwords. There are 5 levels in the zxcvbn score system (taken from github.com/dropbox/zxcvbn):
- score 0: too guessable: risky password (guesses < 10^3)
- score 1: very guessable: protection from throttled online attacks (guesses < 10^6)
- score 2: somewhat guessable: protection from unthrottled online attacks. (guesses < 10^8)
- score 3: safely unguessable: moderate protection from offline slow-hash scenario. (guesses < 10^10)
- score 4: very unguessable: strong protection from offline slow-hash scenario. (guesses >= 10^10)
We do not allow score 0, if you set the
min_score value to 0 instead the default will be used instead.