FastTrack360 Version 12 Online Help

Password Policy

The Password Policy is available via selecting Maintenance > Security Section > Password Policy.

The settings in this section provide you with the ability to determine:

  • the strength of passwords required for login

  • password reset requirements

  • login / session requirements

  • Multi-Factor Authentication, where you wish to impose MFA to particular security roles and user types.

The table below describes the settings in the Password Policy page.

Section

Setting

Details

Section

Setting

Details

Password Strength

Minimum password length

The minimum length the password must be before it can be saved.

 

Password must contain at least one:

  • Numeric Character

  • Uppercase Character

  • Symbol Using !@#$%^&*()

  • Numeric Character - this has replaced ‘Force Password Alphanum’ and will be automatically flagged where true in your existing environment. Where ticked, the user cannot save the password if there is not at least one numeric character in their password.

  • Uppercase Character - where ticked, the user cannot save the password if it does not contain at least one uppercase alpha character.

    • Symbol Using !@#$%^&*() - where ticked, the user cannot save the password if it does not contain at least one symbol as shown in the label.

Password Reset Settings

Days Before Password Expiry

Value entered is the duration the Agency User’s password is valid for. Where this anniversary occurs, on the next login attempt the user is forced to change their password.

 

Enforce Password Reset

Where a user has not created their own password, if this setting is ticked, on first login, the system forces the user to change their password.

 

Apply to User Type(s)

Where ‘Enforce Password Reset’ has been ticked, select the User Type that this rule will apply to.

 

Password Reuse

Where ticked, a value is entered to determine the amount of times a user cannot repeat a previously used password. For example if the value is 4 (default) the user cannot change their password to a previously used password the next 4 occasions they change their password.

Login Settings

Disable User Name auto complete

Where ticked the browser setting (Remember Me) will be disabled for the instance on the FastTrack login page. As such the Username and or Password will not be automatically filled.

 

No of Login Attempts before CAPTCH

Where a number (threshold) is entered in this field, when user attempts to login, if they enter in incorrect credentials, the CAPTCHA pop up is displayed after the threshold number of incorrect attempts has been reached.

 

No of login Attempts before Locking

Where a number (threshold) is entered in this field, the User will be locked out of the System if they exceed the threshold. For Agency Users within the user record in Maintenance > Users, the the Password Details >’Login Blocked’ field is automatically ticked to prevent the user from further login attempts.

For Client Contact / Candidate Users, the login blocked field is also displayed within their records, and can be unlocked by an Agency User to Candidate Online Profile / Contact Online Profile.

The login blocked field will need to be manually unticked to provide the user with access to the system.

 

Locked Login Message

Where a User’s Login is blocked due to exceeding Number of Login Attempts, the message entered here is displayed to the User ie; Account Locked, please contact …. ‘

 

Activate Session Timeout

Where ticked, the system will automatically timeout when the system has been idle as defined in ‘Session Timeout Duration’ below.

 

Session Timeout Duration

Enter in the idle duration (minutes) where ‘Activate Session Timeout’ has been ticked.

 

Security Question Required

Tick to:

  • Prompt the system to force a user to set a Security Question on login, where it has not already been configured.

  • Where ‘Forgot Password’ on the login page is clicked, the system will only dispatch a re-set password email if there is a correctly answered Security Question.

 

Override Login for Timesheet Link

Where ticked, overrides login and takes the user straight to the timesheet or timesheet tab where the timesheet notification received by the user contains a Timesheet Link merge tag that is selected.

Multi Factor Authentication (MFA) Global Settings

Remember Me

Select where you wish to store that the User has successfully authenticated to MFA, and this is remembered for the assigned period of time, thereby avoiding the MFA Authentication screen for that period.

 

Don’t have device - security question option

Where ticked, the user will be able to select this option in the MFA login page.  User will have to answer their Security Question to access the system.

Where the country has mandated that users of particular components of the system (for example people who can access payroll data) must have MFA imposed, this option will not display in the MFA login page, as those users must use MFA.

 

Default Methodology

Determines the default MFA methodology assigned to new user records. Can be TOTP (default) or SMS. To use SMS as an option you must have SMS configured in your environment so authentication messages can be dispatched.

 

MFA Active Date

Displays the Date that MFA has been activated in your environment.

MFA Mandatory Permission Items

List

Displays a list of Countries and user types that will have MFA imposed, if the Country has requested MFA compliance where users access personal information. Click on this list item to view a pop up of the permission items that will invoke MFA. If a user has one or more of these permission items, MFA will be imposed. As this is a legislated compliance requirement, this setting is system defined and cannot be changed by an agency.

MFA Security Roles

List

If, in addition to any Country imposed compliance requirements, you wish to impose MFA on users who have particular Security Roles assigned, use this setting to create your requirements by User Type and Security Role.

For more information on MFA click here.

 

 

Related pages

Classification-Public