Password Policies

Altair SLC Hub supports password policies via Keycloak's built-in policy engine. Password policies are enforced at the realm level and apply to all users who authenticate with a local Keycloak account.

Where to configure it

1. Open the Keycloak Admin Console.
2. Go to Authentication > Policies > Password policy.

Available policies

Keycloak supports the following password policies out of the box:

Policy	Description
Expire password	Requires users to change their password after a given number of days
Hashing iterations	Sets the number of hashing iterations applied to stored passwords
Not recently used	Prevents users from reusing a given number of previous passwords
Not recently used (in days)	Prevents users from reusing a password that was used within a given number of days
Regular expression	Requires passwords to match a given regular expression pattern
Not username	Prevents users from using their username as their password
Not email	Prevents users from using their email address as their password
Not contains username	Prevents users from using a password that contains their username
Special characters	Requires at least one special character
Recovery codes warning threshold	Sets the number of remaining recovery codes at which the user is warned to regenerate them
Uppercase characters	Requires at least one uppercase letter
Lowercase characters	Requires at least one lowercase letter
Digits	Requires at least one numeric digit
Maximum authentication age	Sets the maximum time since the last authentication before the user is required to re-authenticate
Maximum length	Limits passwords to a maximum number of characters
Password blacklist	Prevents users from using passwords that appear in a configured blacklist file

Adding a policy

1. In the Keycloak Admin Console, go to Authentication > Policies > Password policy.
2. Click Add policy and select the policy you want to add.
3. Enter the required value for the policy.
4. Click Save.

Note

Policies take effect immediately for any new password changes. Existing passwords are not retroactively invalidated — users will only be prompted to comply when they next change their password.

Keycloak Documentation

For full details on password policies, see the Keycloak documentation on password policies.

Password Hashing

Password hashing protects user passwords by converting them into a non-reversible format before storage. Altair SLC Hub uses Keycloak's password hashing capabilities to ensure passwords are securely stored.

Configure the Hashing Algorithm

The hashing algorithm specifies which algorithm Keycloak uses when hashing passwords. The default algorithm is argon2, which provides strong security for most use cases.

To configure the hashing algorithm

1. In the Keycloak Admin Console, go to Authentication > Policies > Password policy.
2. In the Hashing Algorithm field, enter the algorithm you want to use.
3. Click Save.

Keycloak Documentation

For a complete list of supported algorithms, see the Keycloak documentation on hash algorithms.

Configure Hashing Iterations

In addition to the algorithm, you can configure the number of times the hash algorithm is applied to a password. More iterations mean slower hashing, which provides better protection against brute-force attacks.

To configure hashing iterations:

1. In the Keycloak Admin Console, go to Authentication > Policies > Password policy.
2. Click Add policy and select Hashing iterations.
3. Enter the number of iterations you want to apply.
4. Click Save.

Higher iteration counts increase security but also require more computational resources during password hashing and authentication. Configure this if your organization has specific security or performance requirements.

Keycloak Documentation

For more details, see the Keycloak documentation on hashing iterations.