Ares Standard: Password Requirements

Starting with Ares 4.6, sites can set password requirements for patrons using Ares authentication. New installations of Ares will contain this requirement by default. Those updating from an older version can set the password requirement manually in the Ares Customization Manager.

Default Password Requirement

The default validation rule for passwords requires at least eight characters with at least one lowercase letter, one uppercase letter, and one number, and is expressed by this regular expression:

^(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{8,}$

Setting the Password Requirement

To set the default validation rule for Ares passwords:

1. In the Ares Customization Manager, navigate to Web | Validation | WebValidation.
2. Change the Validation Type field to RegEx.
3. In the Validation field for password entries, change the value to ^(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{8,}$
4. Click Save.

Editing the Password Requirement

The default password requirement can be edited to fit specific institution needs. This is done by simply editing the regular expression that sets the password requirement.

1. Navigate to Web | Validation | WebValidation in the Ares Customization Manager.
2. Double-click on the line you want to edit (Change Password or Registration).
3. Make sure the Validation Type field is set to RegEx.
4. Edit the Validation field.
5. Click Save.

Password Examples

The default requirement above (^(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{8,}$) breaks down roughly as:

• A ^ and $ character to indicate the beginning and end of the text.
• A series of (?=.*#character class#) elements, which look ahead to make sure at least some part of the text matches the given #character class#, which includes
• \d - any number
• [a-z]any lowercase number
• [A-Z]any uppercase number
• .{8,} to ensure the text is at least eight characters.

Here are some examples of some common complexity requirements expressed as regular expressions. Remember that the web validation fields cannot exceed 255 characters when designing your regular expressions, and to change the rule for both the registration and the change password forms.

^(?=.*\d)(?=.*[a-zA-Z])(?=.*\W).{8,}$

^(?=.*\d)(?=.*[a-zA-Z]).{8,20}$

^.{10,}$

^((?=.*\d)(?=.*[a-zA-Z])|(?=.*\d)(?=.*\W)|

(?=.*[a-zA-Z])(?=.*\W)).{8,}$