Password Management

CMS - Configuration & Setup

Password management involves two sets of configurations, one at the Associate Level and another at the Brand Level.

Associate Level

• Last Login Time: records the timestamp of the associate's last login.
• Number of Unsuccessful Login Attempts: resets upon successful login.
• Date Password Updated: Tracks when the associate's password was last updated.
• Password Reset Pin: used in the 'Forgot Password' flow.
  • Example: passwordPin = birthMonth+"/"+birthDay;

Brand Level

These settings can be configured through CMS > Store Settings.

• Maximum number of incorrect Login attempts: Maximum number of incorrect login attempts allowed.
• Days After Which Account Will Be Locked: Defines the maximum number of days an associate's account will be locked if the password isn't changed.
• Days After Password Reset to Prompt for Upcoming Password: specifies the maximum number of days before prompting an associate to change their password. It is recommended not to exceed 90 days for security compliance.
  • Example of How These Settings Work:
    • Suppose the "Days after which account will be locked" is set to 90, and the "Days after password reset to prompt for upcoming password" is set to 80. Here's how these settings function:
    • On day 80 (10 days before password expiration), associates will start receiving prompts to change their password.
    • The new password will have a 90-day validity before the next expiration.
    • If a password is reset on, say, day 30, it will remain valid for 90 days from the reset date, and the associate will be prompted for another reset on day 80.
    • If the associate enters the correct old password after "Days after which account will be locked" have passed, the POS app treats it as a valid login but forces the user to change the password immediately. The user can't proceed without updating their password if the old password has passed "Days after which account will be locked". Be aware that the system doesn't treat this as an invalid login attempt but requires the user to update their password.

Additional Brand Level Configuration

• Store Associate Password complexity Regex: A Regular Expression that enforces complexity rules for passwords (for example requiring uppercase and lowercase characters).
• Store Associate invalid password error message: The message displayed to the user when a password has expired.
• Password Reset on First Login: This option can be enabled or disabled based on specific requirements. Enabling it forces users to reset their password when logging in for the first time using a password set by corporate.
  

  Note While this setting is generally applied store-wide, it can be overridden for individual associates. For example, an API update disables the feature for a specific associate. Additionally, this setting is tracked at the individual associate level to avoid repeatedly prompting associates to reset their password
• Number of previous passwords that can't be used: Number of previous passwords that can't be used.