Hi all,how can we enable password expiration with smartcards?
I have to implement that within the following framework:
1.) require password change after first login of a newly registered user
2.) require password change after at least 90 days
3.) require certain password quality checking
4.) all of that should be done with smartcard interaction.
-
I know that IBM does not recommend password changes and has documented it in the admin help.
-
I know that setting the last change date in the person document in conjunction with the password expiration interval requires the user to change their passwords when they log on for the first time.
my questions:
1.) do smartcards support password changes which are initiated by the application? (not the automated password change of the smartcard itself)
2.) under what circumstances can the smartcard lock out the user as outlined in the admin help?
Thanks a lot.
Michael
Subject: password expiration and smartcards
The reason to change passwords on a regular basis is the assumption that passwords are being re-used, shared, sniffed off the network, or otherwise compromised, and that by limiting the lifespan of a given password one can limit the exposure window for that compromise.
This doesn’t generally apply for ID files, since the Notes password is only used to unlock the ID file and never sent over the network, but an exceptionally cautious admin might worry about users re-using their Notes password with a less secure application. (In the case where the user’s PC itself is compromised, changing passwords won’t do much good, as the attacker can gain the new password as soon as it is changed.)
When an ID file is protected by a smartcard, there is no actual password being used. A untypable random (except for a few fixed bits to guarantee lack of typability) binary string is used to generate the encryption key that protects the ID file, in the same general fashion as Notes password. However, this random string would have an equivalent password quality of not 6, 8, or even 12, but 128, so you don’t need to worry about somebody guessing the “password”.
You cannot change the password-equivalent stored on a smartcard that protects the ID file, and since that password-equivalent is random and untypable, using server-based password checking with smartcard-enabled ID files would prevent the user from using Notes on more than one workstation at a time, since they would only have one smartcard with the password-equivalent that the server expects.
If password expiration is set for a smartcard-enabled user, then once the server thinks that their password has expired, then they will be locked out of the server.
Subject: Thanks, David for the fantastic answer!