For password fields, password policies can be defined that are checked by the client when a password is entered, and the password is accepted or denied accordingly.
The passwords are encrypted via "bCrypt" with "salt and pepper", based on the Blowfish algorithm. The passwords are checked by the server and the client at login using the challenge/response method instead of a simple comparison.
The JustRelate CRM standard offers a basic implementation. The variable PSC_PWD_VRF_PAT lets you define a regular expression that the password must satisfy. If the variable is set, the feature is active.
In addition, by means of the PSC_PWD_VRF_MSG variable, a message (descriptor) can be defined that is displayed if the password does not match.
Attention: The users delivered with the CRM standard, i.e. PSA, SALESADMIN, CUSTOMIZER, SALESDEMO, etc., no longer have the standard password after the upgrade. All users are saved prior to the upgrade. Afterwards, the system determines which users were modified, updated or added along with the upgrade.
If a user is added, or an existing one has the same password, an empty one, or an old MD5 password, the password is set to NOPWD, and she or he is locked. If the user existed already and had a password different from the one imported, the old password is set again.
These rules do not apply to the user "PSA", because it is the only user that cannot be locked. This user’s password is set to "expired" and must be replaced with a new one when logging in the next time.
If users like CUSTOMIZER, etc., should become usable again, a new password must be assigned to them in the staff member administration.
Passwords can also expire. This feature can be controlled using the PSC_PWD_VLD variable (number of days). If the most recent password change (entry in the password history) is longer ago than the number of days specified, the user is prompted to assign a new password when logging in the next time.
For the user PSA, the value of the variable is set to 3650 (approx. 10 years).
For password management (and other settings), there is a new table, PSA_KEY_VAL. Using the PsaKeyVal.get and PsaKeyVal.put methods, it is possible to read and write several key-value pairs at once. The values are stored for a user (UIC). If you want to store global values, use the user 0. Passwords are encrypted using PsaUti.encrypt.
This central table is not limited to passwords, but can be used for various settings, e.g. filter settings with Chronos, access data for MS Graph, or access to further interfaces (e.g. SMTP, Exchange, Lotus, Echobot).