Use password policy

This feature is covered by the Pre-GA Offerings Terms of the Google Cloud Terms of Service. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the launch stage descriptions.

This document shows you how to use password policy to improve password strength for your new and existing users.

Overview

With password policy you can improve account security by enforcing password complexity requirements. When you enable the feature, you provide a policy that sets the requirements for passwords. You can use password policy as follows:

• Off: the feature is disabled and users can use any password.

• Enforced: policy compliance is enforced as follows:

  • Existing users: for existing users, you can configure one of the following modes:

    • Require mode ("forceUpgradeOnSignin":true): attempts to sign in fail until the user updates to a policy-compliant password.
    • Notify mode ("forceUpgradeOnSignin":false): users are allowed to sign in, but receive a notification to update their password.

  • New or password-reset users: these users are required to choose a password that complies with the policy.

password policy supports the following password requirements:

• Lowercase character required
• Uppercase character required
• Numeric character required
• Non-alphanumeric character required
• Minimum password length
• Maximum password length

The following characters satisfy the non-alphanumeric character requirement if configured:

• ^ $ * . [ ] { } ( ) ? " ! @ # % & / \ , > < ' : ; | _ ~ `

Before you begin

• Preview access: Ask your Google Cloud account team to request access to the password policy preview for your project. Your account team notifies you when you have been granted access to the preview.
• Configure email sign-in.

Important: If you have active users, we recommend that you don't enable require mode unless you intend to immediately enforce that all existing users upgrade to a compliant password. With notify mode, users aren't blocked but still receive warning notifications. This gives them time to upgrade their password. The notifications detail the requirements their password lacks.

Enable password policy

Scope to a tenant

If you are using multi-tenancy, password policy is configured on a per-tenant basis. To learn how to select a tenant, see Selecting a tenant.

Configure password policy

curl

To enable password policy in notify mode, execute the following command:

curl -i -X PATCH -H 'Content-Type: application/json' -H 'Authorization: Bearer ACCESS_TOKEN' -d '
  {
    "passwordPolicyConfig": {
      "passwordPolicyEnforcementState": "ENFORCE",
      "forceUpgradeOnSignin": false,
      "passwordPolicyVersions": [
        {
          "customStrengthOptions": {
            "containsUppercaseCharacter": true,
            "containsLowercaseCharacter": true,
            "containsNumericCharacter": true,
            "containsNonAlphanumericCharacter": true,
            "minPasswordLength": 8,
            "maxPasswordLength": 30
          },
        },
      ],
    },
  }' https://identitytoolkit.googleapis.com/v2/projects/project-id/config?updateMask=passwordPolicyConfig

To enable password policy in require mode, execute the following command:

curl -i -X PATCH -H 'Content-Type: application/json' -H 'Authorization: Bearer ACCESS_TOKEN' -d '
  {
    "passwordPolicyConfig": {
      "passwordPolicyEnforcementState": "ENFORCE",
      "forceUpgradeOnSignin": true,
      "passwordPolicyVersions": [
        {
          "customStrengthOptions": {
            "containsUppercaseCharacter": true,
            "containsLowercaseCharacter": true,
            "containsNumericCharacter": true,
            "containsNonAlphanumericCharacter": true,
            "minPasswordLength": 8,
            "maxPasswordLength": 30
          },
        },
      ],
    },
  }' https://identitytoolkit.googleapis.com/v2/projects/project-id/config?updateMask=passwordPolicyConfig

Disable password policy

curl

To disable password policy, execute the following command:

curl -i -X PATCH -H 'Content-Type: application/json' -H 'Authorization: Bearer ACCESS_TOKEN' -d '
  {
    "passwordPolicyConfig": {
      "passwordPolicyEnforcementState": "OFF",
      "forceUpgradeOnSignin": false,
      "passwordPolicyVersions": [
        {
          "customStrengthOptions": {
            "containsUppercaseCharacter": true,
            "containsLowercaseCharacter": true,
            "containsNumericCharacter": true,
            "containsNonAlphanumericCharacter": true,
            "minPasswordLength": 8,
            "maxPasswordLength": 30
          },
        },
      ],
    },
  }' https://identitytoolkit.googleapis.com/v2/projects/project-id/config?updateMask=passwordPolicyConfig