Security Preferences

Security Preferences configure security-related features of Order Management. The following subsections are included:

• Password Policy – Configure user password requirements
• Forgotten Password - Forgotten password
• Account Manager - Set the default role for accounts created in Account Manager
• Addresses – Use Internet address groups

Password Policy

By default, the password policies are set to Salesforce minimums for new user accounts and existing user accounts where the policy has not been set. An Administrator can also set a minimum password policy requirement by following the PCI rules. This page lets you configure user password requirements.

You can't change the following security requirements.

• User accounts not used for 90 days are deactivated. Upon account deactivation, Order Management sends an email notification to the user. Reactivation can require a password reset by an administrator.
  Note: The Administrator can select the Active checkbox on the User Detail page in Administration: Security > Users to reactivate the account.
• User accounts not used for 180 days are deleted. Upon account deletion, Order Management sends an email notification to the user. The user account must be re-created.

Accounts that have both the Administrator or General and the Report Author roles are subject to the more restrictive of the policies.

Three policies exist:

• General Roles: Applies to all user accounts that do not have the Administrator or Report Author roles.
• Administrator Role: Applies to all user accounts that have the Administrator role.
• Report Author: Applies to all user accounts that have the Report Author role. This policy is subject to PCI requirements and can't be edited.

Password Requirements

The default Salesforce password policies are as follows:

• Minimum Password Length: 12 characters
• Require Mixed Case:
  • At least one lowercase character
  • At least one uppercase character
  • At least one numeric character
  • At least one special character
• Enforce Expiration: 90 days
• Restrict Password Re-Use: eight passwords
• Require Confirmation on New Password: On

Minimum password policy requirements follow PCI rules, as follows:

• Don't use group, shared, or generic accounts and passwords. Give each user an explicit account.
• Ensure that a policy is set for both General and Administrator roles.
• Minimum Password Length: eight characters
• Require Mixed Case:
  • At least one lowercase character
  • At least one uppercase character
  • At least one numeric character
  • At least one special character
• Enforce Expiration: 90 days
• Restrict Password Re-Use: eight passwords
• Require Confirmation on New Password: On
• When creating an account, require the user to change the password upon logging in for the first time. (Set this requirement on the user account, not the password policy.)
• Don't write down or store a password where an unauthorized person could gain access to it.

Forgotten Password

When a user forgets the password to any of the Order Management modules, they can request a password reset link to reset it as follows:

1. Select the Forgot Password link on an Order Management module login page.
2. From the Send Email popup window, enter a username, then click Send Email to receive the password reset link. If a valid email address exists, an email is sent with a password reset link. If the user account has no verified email address, an Administrator must reset the password on the User Detail page in Administration: Security > Users.
   Note: The password reset link expires after 24 hours. If the availability of the password reset link has expired, the message, “The reset password link is invalid or has expired" appears.

   The Email User Password Reset template can be customized for the password reset.

Account Manager

This page is only available if you are using Account Manager to manage Order Management accounts. It lets you select the Order Management role that is automatically assigned to normal user accounts when they are given the Order Management User role in Account Manager. (Administrator accounts are automatically assigned the Administrator role.) Select one from the dropdown list and click Update.

Addresses (Not Used)

This page lets you create internet address groups and add internet addresses into that group. This functionality is not used.

To add an internet address group, do as follows:

1. In Order Management Administration: click Settings > Preferences.
2. Click the Security tab.
3. Click Addresses.
4. From the Internal Address Groups page, click Add Group and add an internet address group. The page refreshes with a New Group link.
5. Assign a name to the group. Click Edit and assign a Label, Short Label, and Description for this group.
6. To accept the new address group, click Update. To discard it, click Cancel . To delete the group, click the trash can icon ().
7. Click the new group’s link. The Edit Addresses page appears. Enter the Internet Address and the Mask Address and click Add. A new internet address item is listed. You can add multiple addresses to this group.
8. To change the internet address, click Edit. To return to the Internet Address Groups page without saving the address, click Cancel . To discard this internet address, click the trash can icon ().