Password Policy

Authelia allows administrators to configure an enforced password policy.

Configuration

Example Configuration

This section is intended as an example configuration to help users with a rough contextual layout of this configuration section, it is not intended to explain the options. The configuration shown may not be a valid configuration, and you should see the options section below and the navigation links to properly understand each option individually.

configuration.yml
password_policy:
  standard:
    enabled: false
    min_length: 8
    max_length: 0
    require_uppercase: false
    require_lowercase: false
    require_number: false
    require_special: false
  zxcvbn:
    enabled: false
    min_score: 3

Options

This section describes the individual configuration options.

standard

This section allows you to enable standard security policies.

enabled

boolean false not required

Enables standard password policy.

min_length

integer 8 not required

Determines the minimum allowed password length.

max_length

integer 0 not required

Determines the maximum allowed password length.

require_uppercase

boolean false not required

Indicates that at least one UPPERCASE letter must be provided as part of the password.

require_lowercase

boolean false not required

Indicates that at least one lowercase letter must be provided as part of the password.

require_number

boolean false not required

Indicates that at least one number must be provided as part of the password.

require_special

boolean false not required

Indicates that at least one special character must be provided as part of the password.

zxcvbn

This password policy enables advanced password strength metering, using zxcvbn.

Note that this password policy do not restrict the user’s entry it just gives the user feedback as to how strong their password is.

enabled

boolean false not required

Important Note

Only one password policy can be applied at a time.

Enables zxcvbn password policy.

min_score

integer 3 not required

Configures the minimum zxcvbn score allowed for new passwords. There are 5 levels in the zxcvbn score system (taken from github.com/dropbox/zxcvbn):

  • score 0: too guessable: risky password (guesses < 10^3)
  • score 1: very guessable: protection from throttled online attacks (guesses < 10^6)
  • score 2: somewhat guessable: protection from unthrottled online attacks. (guesses < 10^8)
  • score 3: safely unguessable: moderate protection from offline slow-hash scenario. (guesses < 10^10)
  • score 4: very unguessable: strong protection from offline slow-hash scenario. (guesses >= 10^10)

We do not allow score 0, if you set the min_score value to 0 instead the default will be used instead.