Password change Policy in Clarity PPM

Products

• Clarity PPM On Premise
• Clarity PPM SaaS

Issue/Introduction

We would like to know what the password change policy in Clarity is. We have been receiving reports from end users that they are being asked to change their password frequently.

Environment

Latest version tested against: 15.9.2

Resolution

Note that password policy in Clarity would be relevant if the authentication is not being handled outside the application, such as through an SSO IdP.

Check how many days have been mentioned against Administration -> General Settings -> System Options -> "Number of Days Until Password Expires" field, within the application.

The two circumstances in which a password change would be forced upon an user would be as follows:
1. When "Force Password Change" flag is set against that user's account or
2. When the last password change was more than x number of days ago. x being the number of days mentioned in System Options as mentioned above.

For tracking purposes, use the value from the System Options field and create an NSQL Portlet based on a query such as the one below. This will help you keep track of users who could report that they were asked to reset their password. If you do notice that end users are being asked to reset password frequently, check for custom processes or jobs that could be acting upon the cmn_sec_users table.

SELECT
    id,
    last_pwd_change,
    force_pwd_change,
    user_name,
    user_status_id
FROM
    cmn_sec_users
WHERE
        last_pwd_change > SYSDATE - 90
    OR
        force_pwd_change = 1;