Managing Authentication and Password Policies on NSX Manager

Products

• VMware NSX

Issue/Introduction

This article provides guidance on viewing and configuring authentication policies, password expiration, and password complexity requirements for local users on NSX Manager.

• Need to check or modify the default password complexity settings.
• Administrative queries regarding how to set authentication policies for CLI or vIDM.
• Notifications regarding upcoming password expiration for local accounts.

Environment

VMware NSX

Cause

NSX Manager enforces default security policies, including a 90-day password expiration and specific complexity requirements. These settings are configurable via the NSX CLI.

Resolution

To manage password and authentication policies, log in to the NSX Manager or Edge node as the admin user and use the following commands:

I. Viewing Current Policies To view the current configuration, use the following commands:

1. View password complexity requirements: get password-complexity
2. View CLI authentication policy: get auth-policy cli
3. View vIDM authentication policy: get auth-policy vidm
4. View specific user expiration (e.g., for admin): get user admin password-expiration

II. Modifying Policies To change the settings, use the corresponding set commands:

1. Set password complexity: set password-complexity <complexity-requirement>
2. Set CLI authentication policy (e.g., lockout period or attempts): set auth-policy cli <parameter>
3. Set vIDM authentication policy: set auth-policy vidm <parameter>
4. Change password expiration for a specific user: set user <username> password-expiration <days>

Additional Information

• For detailed recovery steps if a password has already expired, refer to KB 408091.
• To speak with a customer representative or a Support Engineer see Contact Support. Scroll to the bottom of the page and click on your respective region.
• For official documentation, see NSX Authentication Policy Settings.