Staff Password Requirements

As of Ares 5.0, password requirements for staff are set using the StaffPasswordComplexity key in the Ares Customization Manager. The default setting for the key will enforce a complex password requiring at least 8 characters, including an upper and lower case letter and a number. The key can be set to .* to remove the requirement, however, the Staff Manager will also have an override ability that will prompt 'Password does not meet staff password requirements. Would you still like to set the password?' when a password does not meet the specified requirements in the key.

Default Password Requirement

The default validation rule for passwords now requires at least eight characters with at least one lowercase letter, one uppercase letter, and one number, and is expressed by this regular expression:

^(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{8,}$

Editing the Password Requirement

The default staff password requirement can be edited to fit specific institution needs. This is done by simply editing the regular expression that sets the password requirement:

1. Navigate to System | Password Expiration in the Ares Customization Manager.
2. Locate the StaffPasswordComplexity key.
3. Change the value to the regular expression you want to use.
4. Click Save.

Password Examples

The default requirement above (^(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{8,}$) breaks down roughly as:

• A ^ and $ character to indicate the beginning and end of the text.
• A series of (?=.*#character class#) elements, which look ahead to make sure at least some part of the text matches the given #character class#, which includes
• \d - any number
• [a-z]any lowercase number
• [A-Z]any uppercase number
• .{8,} to ensure the text is at least eight characters.

Here are some examples of some common complexity requirements expressed as regular expressions:

^(?=.*\d)(?=.*[a-zA-Z])(?=.*\W).{8,}$

^(?=.*\d)(?=.*[a-zA-Z]).{8,20}$

^.{10,}$

^((?=.*\d)(?=.*[a-zA-Z])|(?=.*\d)(?=.*\W)|

(?=.*[a-zA-Z])(?=.*\W)).{8,}$

Unique Password Requirements

Staff passwords will check the new password using a configurable number (default value: 4) of previous passwords for uniqueness when a staff user is changing his/her password. This will prevent staff users from reusing a previous password or rotating through similar passwords. 

The default can be changed in the Ares Customization Manager by changing the default value of the StaffPreviousPasswordCount key located under System | Password Expiration.

• If the value is set to 4, then the user must have 4 unique passwords before an old password can be reused.
• If the value is set to 0, the password will not be checked against the user's password history when updating the password.

Password Expiration

The StaffPasswordExpirationDays customization key located under System | Password Expiration in the Ares Customization Manager sets the number of days before a password expires for a staff member. If the staff user's last password change exceeds the StaffPasswordExpirationDays, the user will be redirected to the change password form upon login to the Ares Client. The default value for this key is 180 days. 

Encryption for Stored Passwords 

Staff passwords are stored with enhanced encryption methods using the Password-Based Key Derivation Function 2 (PBKDF2) hashing strategies. The iterations (default value: 156,000) store the hashed passwords as an algorithm. When a user logs in with a password, it will be compared with the hash algorithm to verify the password is correct before permitting clearance into Ares.

The default value can be changed in the Ares Customization Manager by changing the value of the StaffPasswordHashingIterations key located under System | Password Expiration. If you wish to change the default iterations, it's highly recommended to contact support for the number of iterations that work best for the speed of your computer and the hash algorithm. Generally, hash iterations should not be set to less than 100,000. 

• Utilizes 140-2 compliant encryption algorithms
• Is activated via the Windows group policy

FIPS compliance is supported with Ares by the password hashing customization keys (StaffPasswordHashingIterations and WebPasswordHashingIterations) that are set in the Customization Manager.