> For the complete documentation index, see [llms.txt](https://docs.cybus.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cybus.io/2-6-1/access/security/password-policy-configuration.md).

# Password Policy Configuration

Define and implement organization-specific password policies.

You can define customized password rules to strengthen security based on your organization's needs. Configure these rules using either:

* **Kubernetes deployment**: Set the `global.authentication.passwordPolicyRules` Helm value.
* **Docker deployment**: Use the `CYBUS_AUTH_PASSWORD_POLICY_RULES` environment variable.

If not configured, the default password rule is `{"min": 5}`, which requires passwords to have a minimum length of five characters without any specific character type requirements.

## Configuring Password Rules

{% tabs %}
{% tab title="Kubernetes" %}

## Configuring Password Rules (Kubernetes)

1. Open the `values.yaml` file.
2. Set the `global.authentication.passwordPolicyRules` Helm value to configure your password rules. For a list of all configuration properties, see [Password Parameters](#password-parameters).

{% code lineNumbers="true" %}

```yaml
global:
  authentication:
    passwordPolicyRules: '{"min": 10, "upper": 1, "lower": 1, "numeric": 1, "symbol": 1}'
```

{% endcode %}

3. Upgrade your Helm chart to apply the Helm configuration changes. For details, see [Applying Helm Configuration Changes](/2-6-1/cybus-helm-charts/working-with-cybus-helm-charts.md#applying-helm-configuration-changes).

{% code lineNumbers="true" %}

```bash
helm upgrade -n ${NAMESPACE} ${INSTALLATION_NAME} oci://repo.cybus.io/charts/connectware -f values.yaml
```

{% endcode %}

4. Verify your configuration.
   * Check the auth-server logs for any errors.
   * Try creating a new user with a password that does not meet the requirements to test.
     {% endtab %}

{% tab title="Docker" %}

## Configuring Password Rules (Docker)

1. Navigate to your Connectware installation directory. If you have used the default values during installation, this is the installation folder: `/opt/connectware`. The directory contains an `.env` file that is loaded when starting Connectware.
2. Open the `.env` file.
3. Set the `CYBUS_AUTH_PASSWORD_POLICY_RULES` environment variable to configure your password rules. For a list of all configuration properties, see [Password Parameters](#password-parameters).

{% code lineNumbers="true" %}

```yaml
environment:
  - CYBUS_AUTH_PASSWORD_POLICY_RULES={"min": 10, "upper": 1, "lower": 1, "numeric": 1, "symbol": 1}
```

{% endcode %}

4. Start or restart Connectware. For more information, see [Restarting Connectware](/2-6-1/deployment/restarting-connectware.md).
5. Verify your configuration.
   * Check the auth-server logs for any errors.
   * Try creating a new user with a password that does not meet the requirements to test.
     {% endtab %}
     {% endtabs %}

## Password Parameters

The `CYBUS_AUTH_PASSWORD_POLICY_RULES` variable and `global.authentication.passwordPolicyRules` Helm value parameters must contain a properly formatted JSON object. The following parameters are available:

| Parameter | Description                          | Example                                                              |
| --------- | ------------------------------------ | -------------------------------------------------------------------- |
| `min`     | Minimum total password length        | `{"min": 8}`                                                         |
| `lower`   | Minimum number of lowercase letters  | `{"lower": 2}` for at least two lowercase characters like `a` or `b` |
| `upper`   | Minimum number of uppercase letters  | `{"upper": 1}` for at least one uppercase character like `A` or `B`  |
| `numeric` | Minimum number of numeric digits     | `{"numeric": 1}` for at least one digit like `1` or `2`              |
| `symbol`  | Minimum number of special characters | `{"symbol": 1}` for at least one symbol like `$` or `#`              |

* **Parameter values**: Each parameter accepts a single integer value.
* **Optional parameters**: All parameters are optional in the JSON object.
* **Disabled rules**: Setting any value to zero (e.g., `{"upper": 0}`) disables that specific rule.
* **Character classification**: Character classes are evaluated using Unicode Regular Expression category parameters. For details on the exact definition of the character classes, see <https://unicode.org/reports/tr18/#General_Category_Property>.

## Troubleshooting

The environment variable is validated during system startup. If there is a misconfiguration (e.g., JSON syntax error), the auth-server microservice will fail to start and log an appropriate error message. Check the auth-server microservice logs for troubleshooting.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.cybus.io/2-6-1/access/security/password-policy-configuration.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.