Default account security policies
HCL Commerce provides two default account policies: Administrators and site users.
Administrator account policy
This policy is the default account policy for administrators. This policy defines the default account lockout policy and default password policy.
The default account lockout policy contains the following attributes:
Attribute | Default value |
---|---|
Account lockout
threshold Note: Account lockout does not work with LDAP
enabled. |
3 attempts |
Consecutive unsuccessful login delay | 20 seconds |
The default password policy contains the following attributes:
Attribute | Default value |
---|---|
Whether the user ID and password can match | N (no, they cannot match) |
Maximum occurrence of consecutive characters | 3 characters |
Maximum instances of any character | 4 instances |
Maximum lifetime of the passwords | 90 days |
Minimum number of alphabetic characters | 1 alphabetic character |
Minimum number of numeric characters | 1 numeric character |
Minimum length of password | 8 characters |
Number of previous passwords to check against when the user selects a new password | 4 passwords |
The default wcsadmin
administrator user that is shipped with HCL Commerce is assigned the Administrators policy.
Site user account policy
This policy is the default account policy for registered site users (otherwise commonly known as customers, end users, or shoppers) who shop on your store. This policy contains the default account lockout policy and default password policy for your site users.
The default account lockout policy for site users contains the following default attributes:
Attribute | Default value |
---|---|
Account lockout
threshold Note: Account lockout does not work with LDAP
enabled. |
6 attempts |
Consecutive unsuccessful login delay | 10 seconds |
The default password policy for site users contains the following default attributes:
Attribute | Default value |
---|---|
Whether the user ID and password can match | N (no, they cannot match) |
Maximum occurrence of consecutive characters of the same type 1 | 3 characters |
Maximum instances of any character | 4 instances |
Maximum lifetime of the passwords | 180 days |
Minimum number of alphabetic characters | 1 alphabetic character |
Minimum number of numeric characters | 1 numeric character |
Minimum length of password | 8 characters |
Number of previous passwords to check against when the user selects a new password | 1 password |
1 For example, a password of 123xyXYZ is valid, but a password of 1234xyXYZ is not since "1234" is more than three consecutive characters of the same type.
Customers that complete self-registration are assigned the site user policy.