1cfe1aff13
* root: initial rename * web: rename custom element prefix * root: rename external functions with pb_ prefix * root: fix formatting * root: replace domain with goauthentik.io * proxy: update path * root: rename remaining prefixes * flows: rename file extension * root: pbadmin -> akadmin * docs: fix image filenames * lifecycle: ignore migration files * ci: copy default config from current source before loading last tagged * *: new sentry dsn * tests: fix missing python3.9-dev package * root: add additional migrations for service accounts created by outposts * core: mark system-created service accounts with attribute * policies/expression: fix pb_ replacement not working * web: fix last linting errors, add lit-analyse * policies/expressions: fix lint errors * web: fix sidebar display on screens where not all items fit * proxy: attempt to fix proxy pipeline * proxy: use go env GOPATH to get gopath * lib: fix user_default naming inconsistency * docs: add upgrade docs * docs: update screenshots to use authentik * admin: fix create button on empty-state of outpost * web: fix modal submit not refreshing SiteShell and Table * web: fix height of app-card and height of generic icon * web: fix rendering of subtext * admin: fix version check error not being caught * web: fix worker count not being shown * docs: update screenshots * root: new icon * web: fix lint error * admin: fix linting error * root: migrate coverage config to pyproject
41 lines
1.3 KiB
Markdown
41 lines
1.3 KiB
Markdown
---
|
|
title: Policies
|
|
---
|
|
|
|
## Standard Policies
|
|
|
|
---
|
|
|
|
### Reputation Policy
|
|
|
|
authentik keeps track of failed login attempts by source IP and attempted username. These values are saved as scores. Each failed login decreases the score for the client IP as well as the targeted username by 1 (one).
|
|
|
|
This policy can be used, for example, to prompt clients with a low score to pass a captcha before they can continue.
|
|
|
|
## Expression Policy
|
|
|
|
See [Expression Policy](expression.md).
|
|
|
|
## Password Policies
|
|
|
|
---
|
|
|
|
### Password Policy
|
|
|
|
This policy allows you to specify password rules, such as length and required characters.
|
|
The following rules can be set:
|
|
|
|
- Minimum amount of uppercase characters.
|
|
- Minimum amount of lowercase characters.
|
|
- Minimum amount of symbols characters.
|
|
- Minimum length.
|
|
- Symbol charset (define which characters are counted as symbols).
|
|
|
|
### Have I Been Pwned Policy
|
|
|
|
This policy checks the hashed password against the [Have I Been Pwned](https://haveibeenpwned.com/) API. This only sends the first 5 characters of the hashed password. The remaining comparison is done within authentik.
|
|
|
|
### Password-Expiry Policy
|
|
|
|
This policy can enforce regular password rotation by expiring set passwords after a finite amount of time. This forces users to set a new password.
|