Default password policy

The v2.0.0 upgrade installs a default password policy by inserting a row into cypex.t_config with key password_policy. This page documents the policy, how to verify it on your instance, and how to override it.

The default policy

The migration inserts:

1
2
3
4
5
6
7
{
  "minLength": 4,
  "minUppercase": 0,
  "minLowercase": 0,
  "minNumbers": 0,
  "minSpecial": 0
}

This is very permissive by design. The rationale is that shipping a working default is preferable to locking existing users out at upgrade time. Once the upgrade is complete, administrators should review the policy and tighten it to match their security requirements.

Idempotency

The insert uses ON CONFLICT (key) DO NOTHING:

1
2
3
4
5
6
INSERT INTO cypex.t_config (key, value)
VALUES (
  'password_policy',
  '{"minLength": 4, "minUppercase": 0, "minLowercase": 0, "minNumbers": 0, "minSpecial": 0}'
)
ON CONFLICT (key) DO NOTHING;

Consequences:

If no password policy is present in cypex.t_config, the v2.0.0 default is inserted.
If a password policy is already present, the existing policy is preserved.

This means deployments that already configured a custom policy do not have it overridden by the upgrade.

Verification

To see what policy is currently in effect:

1
SELECT value FROM cypex.t_config WHERE key = 'password_policy';

Compare the result against the default above. If they differ, the deployment either shipped with a custom policy or an admin overrode it after the upgrade.

Overriding the policy

There are two ways to change the password policy after the upgrade.

Through the admin panel

The CYPEX admin panel exposes the password policy under Authentication → Password policy. Edit the JSON value and save. The change takes effect on the next password change attempt.

Through direct SQL

1
2
3
UPDATE cypex.t_config
SET value = '<new-policy-json>'
WHERE key = 'password_policy';

The <new-policy-json> payload must conform to the same shape as the default. The backend validates it on the next read.

Schema reference

Key	Type	Default	Meaning
`minLength`	integer	4	Minimum password length.
`minUppercase`	integer	0	Minimum uppercase characters required.
`minLowercase`	integer	0	Minimum lowercase characters required.
`minNumbers`	integer	0	Minimum digits required.
`minSpecial`	integer	0	Minimum special characters required.

A more restrictive example for a production deployment:

1
2
3
4
5
6
7
{
  "minLength": 12,
  "minUppercase": 1,
  "minLowercase": 1,
  "minNumbers": 1,
  "minSpecial": 1
}

Notes for LDAP-enabled deployments

For deployments using LDAP authentication, the CYPEX password policy applies only to local CYPEX users. LDAP users authenticate against the LDAP server, which has its own password policy. The default policy in cypex.t_config does not affect them.

If you want to enforce password complexity on LDAP users, configure it on the LDAP server itself.