Password Requirements

In order to comply with PCI security requirements, the following minimum password settings are required. Merchants can select to make the requirements stricter than those required by Vindicia, for their users. The following info will be added to the MAC guide for merchant input. If using Vindicia IDP (ulm) as the Portal access Identity Provider, add the Merchant input in to the ticket based on VIN-19073 template.

Name	Description	Required Value
Minimum Password Length	The number of characters required for a password	At least 8
Password Lifetime	The length of time before user is required to change password.	Minimum 90 daysNote: For Vindicia IDP, provide the value in seconds (7,776,000).
Password Historical Check Count	Number of last passwords that can’t be reused for new password. When a user tries to change to a previously used password, system will check the last X passwords.	At least 5
Maximum Number of MFA Retries	Maximum number of MFA verification attempts by user.After this number of retries, user is locked.	Maximum 5
Email Domain Blocklist	Users will be unable to onboard with blocked email domains. If left blank, there are no blocked email domains.
Email Domain Allowlist	Users will only be able to onboard with allowed email domains. If left blank, any email domain can be used with the exception of domains listed under Email Domain Blocklist.
Parent topic:Vindicia Portal Users and Authentication

Home

Guides

APIs