[sims] Password

[Edu-IT]

Where in SIMS - if anywhere - can you set minimum password requirements?

[matt40k]

Use Windows authentication.

[pete]

You can't, AFAIK. Especially given how many change requests there are for this feature (search for "password" in the change requests).

 

You could use AD and set your password complexity there (using granular password policies if necessary) instead.

[Edu-IT]

Use Windows authentication.

Does that then give them single sign on though? I want them to still be prompted to login to SIMS.

[Edu-IT]

Does that involve me adding something to the connect.ini too?

[vikpaw]

Yes it's like single sign-on, and you have to edit the central, or local if they are all local and not redirected, connect.ini

There are two options, automagic, or prompt. The prompt just means they have to hit OK, but gives you / the user the option to login with an account that doesn't use Windows Auth - I use this for troubleshooting if i want to go in as admin.

 

I read in some recent FMS release notes that they have increased the password complexity and added features regarding forcing a password change at next logon etc.

 

There was some work being done by someone to use Trusted Auth in SIMS, but still prompt them enter credentials. It wasn't safe, so pointless in effect, but as a general deterrent, could work. i think the member doing it was sovietrussia but i can't be certain.

 

You could always just tell the users they have to choose a new password that is 8+chars with xyz complexity - they will most likely be so annoyed, they'll believe you and do it anyway

[matt40k]

I want them to still be prompted to login to SIMS.

 

That's a false sense of security, also it adds a man-in-the-middle attack, WinKey + L is a better option. SQL logins are always going to be a lot less secure then AD auth.

 

Personally, AD is authentication, SQL is a relational database, let the authentication server handle the authentication and the database handle to the data. Don't try and make something into something it isn't.

[ITGURU]

New SIMS logins now require you to have a minimum of 8 characters.

[Edu-IT]

New SIMS logins now require you to have a minimum of 8 characters.

Does that work if you use the 'change password' option through system manager, and then have them change their password on login?

[ITGURU]

I haven't tried it that way, although I'm pretty sure that when it asks for the new password it will say it has to be a minimum of 8 characters. Older passwords less than 8 still work, but if you have to reset a user, it will require 8 minimum.

[pete]

I haven't tried it that way, although I'm pretty sure that when it asks for the new password it will say it has to be a minimum of 8 characters. Older passwords less than 8 still work, but if you have to reset a user, it will require 8 minimum.

 

And some people (who should really know better) aren't happy:

 

 

(redacted to reduce drama).

 

Yup, March 2015 a school was (still is?) using 4-digit passwords for everything.

[Andrew_C]

And some id10t5 (who should really know better) aren't happy:

 

There, is that better?

[pete]

There, is that better?

 

I'd go for something stronger like "failure to protect personal data likely to put your school into special measures and the responsible person in jail."

[vikpaw]

It had 9 votes and a score of 3! ... :s I've just reduced it to 10 votes, score 2.

Odd the code in the title implies it's an old ticket from 2013 doesn't it.

Still if you want your password to have legs - 4 is a good number to have