What are ForgeRock IDM's password policy capabilities?

ForgeRock IDM provides a comprehensive password policy engine for managing password requirements on Managed User objects. Unlike AM's authentication-time password validation, IDM's policies govern the passwords stored in IDM's managed repository — enforcing rules at account creation, self-service password reset, and administrator password change operations.

IDM password policies are configured in the authentication.json and managed.json configuration files and enforce rules such as:

• Minimum/maximum length — Password must be between N and M characters.
• Character class requirements — Must contain uppercase letters, lowercase letters, numbers, and/or special characters, with configurable minimum counts per class.
• Disallowed values — Password cannot match the user's own name, email, or username (attribute-based exclusions).
• Password history — Cannot reuse the last N passwords, enforced using stored password hashes.
• Dictionary check — Integration with a configurable word list to reject common passwords.
• Minimum age — User cannot change their password again until N hours/days have passed.
• Maximum age — Password expires after N days; IDM tracks expiry and triggers account lockout or forced password change workflows.

IDM stores passwords using configurable hashing algorithms — PBKDF2, bcrypt, SHA-256, or MD5 (the latter not recommended). The default is PBKDF2 with a configurable iteration count. Passwords are never returned via IDM REST APIs; they can only be set, updated, or validated.

When IDM is integrated with AM and DS, AM's authentication trees call DS for password validation. IDM's password policy applies at write time (registration, reset), while DS enforces its own LDAP password policy at authentication time. Keeping these in sync — especially regarding lockout thresholds — is an important configuration concern in integrated deployments.