Setting Password Requirements and Expiring Passwords


See Also: Multifactor Authentication and Single Sign On Integrations


Password Requirements and Options

LegalServer enforces the following requirements for user account passwords.

  • Must have at least 1 letter and 1 number

  • Minimum length is 8 characters

  • Cannot be a series of letters ending with either 1, 12, 123, or 1234

  • Cannot be 1234abcd or 1234qwer

  • Special characters like ! @ # $ % ^ & * ( ) { } are supported. And probably encouraged by your agency.


Site administrators can require these additional elements by changing Site Settings-> Security Settings:

  • Passwords must contain least one upper case character

  • Passwords must contain at least one lower case character

  • Passwords must contain at least one special character


Changing any or all of these options to "Yes" will only affect newly chosen passwords.


Expiring Passwords

LegalServer does not expire passwords by default. Password expiration is no longer recommended by NIST (SP 800-63B Section 5.1.1.2).


Site administrators can change this on the Admin > Site Settings page.


Users with an expired password are taken to the "Change Password" page after logging in with an expired password.


Note: Selecting a password expiration takes effect immediately and applies retroactively. For example, if a site is not using password expiration then selects 90 days, all users who have not changed their password in 90 days will be forced to change their password on the next login.