Description

Ensure the identity domain password policy sets passwords to expire after no more than 365 days. The Expires after (days) value should be between 1 and 365, and not 0, because 0 means passwords never expire.

Rationale

Passwords that never expire can remain valid indefinitely, even if they were leaked in a breach that nobody noticed. Requiring a change at least once a year limits how long an exposed password can be used. Combined with long passwords and MFA, this gives an extra safety net for Console accounts.

Impact

  • Passwords must be changed at least once a year

  • Limits how long an exposed password stays valid

  • Users receive password expiry prompts

Default Value

The default expiry depends on the password policy in use, and the value can be set to 0, which means passwords never expire.

Pre-Requisites

  • Identity domain administrator role

Test Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).

  3. Select the Domain policies tab (or Settings > Password policy on some consoles), and select the password policy that applies to your users.

  4. Check the Expires after (days) value.

  5. If it is 0 or greater than 365, follow the implementation steps.

Implementation Steps

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).

  3. Select the Domain policies tab (or Settings > Password policy on some consoles), and select the password policy that applies to your users.

  4. Select Edit password rules and choose Custom.

  5. Set Expires after (days) to a value between 1 and 365.

  6. Select Save changes.

Backout Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).

  3. Select the Domain policies tab (or Settings > Password policy on some consoles), and select the password policy that applies to your users.

  4. Select Edit password rules and choose Custom.

  5. Set Expires after (days) back to its previous value and select Save changes.

Reference