Is there a query to identify which password requirements are not being met?

[monik0277]

Hi Everyone, I am trying to see if there is a query I can run that will tell me which of our password requirements a user is not meeting when trying to set their password. 

I believe there is something I can run that will give me this info. Thank you very much in advance for any assistance.

[danspav]

Hi @monik0277,

Like @caiosalonso mentioned, there are multiple sources for credentials.

If you are using Splunk authentication (local Splunk accounts) then the password complexity rules are kept in authentication.conf.

This REST call will show you the password rules:

| rest splunk_server=local /services/configs/conf-authentication/splunk_auth
| table minPasswordDigit, minPasswordLength, minPasswordLowercase, minPasswordSpecial, minPasswordUppercase, passwordHistoryCount, enablePasswordHistory, forceWeakPasswordChange, expirePasswordDays

You can also see the rules through the UI under Settings -> Users and Authentication -> Password Management

Cheers,
Daniel

[caiosalonso]

Hi,

For which authenticator provider do you want to run this kind of query?

Do you already have audit logs available in Splunk showing when a user sets the password in your authentication provider? If that is the case, are you able to provide a sample?