What are ForgeRock IDM's password policy capabilities?

ForgeRock IDM provides a comprehensive password policy engine for managing password requirements on Managed User objects. Unlike AM's authentication-time password validation, IDM's policies govern the passwords stored in IDM's managed repository — enforcing rules at account creation, self-service password reset, and administrator password change operations.

IDM password policies are configured in the authentication.json and managed.json configuration files and enforce rules such as:

• Minimum/maximum length — Password must be between N and M characters.
• Character class requirements — Must contain uppercase letters, lowercase letters, numbers, and/or special characters, with configurable minimum counts per class.
• Disallowed values — Password cannot match the user's own name, email, or username (attribute-based exclusions).
• Password history — Cannot reuse the last N passwords, enforced using stored password hashes.
• Dictionary check — Integration with a configurable word list to reject common passwords.
• Minimum age — User cannot change their password again until N hours/days have passed.
• Maximum age — Password expires after N days; IDM tracks expiry and triggers account lockout or forced password change workflows.

IDM stores passwords using configurable hashing algorithms — PBKDF2, bcrypt, SHA-256, or MD5 (the latter not recommended). The default is PBKDF2 with a configurable iteration count. Passwords are never returned via IDM REST APIs; they can only be set, updated, or validated.

When IDM is integrated with AM and DS, AM's authentication trees call DS for password validation. IDM's password policy applies at write time (registration, reset), while DS enforces its own LDAP password policy at authentication time. Keeping these in sync — especially regarding lockout thresholds — is an important configuration concern in integrated deployments.

Invest now in Acorns!!! 🚀
Join Acorns and get your $5 bonus!

Acorns is a micro-investing app that automatically invests your "spare change" from daily purchases into diversified, expert-built portfolios of ETFs. It is designed for beginners, allowing you to start investing with as little as $5. The service automates saving and investing. Disclosure: I may receive a referral bonus.

Invest now!!! Get Free equity stock (US, UK only)!

Use Robinhood app to invest in stocks. It is safe and secure. Use the Referral link to claim your free stock when you sign up!.

The Robinhood app makes it easy to trade stocks, crypto and more.

Webull! Receive free stock by signing up using the link: Webull signup.