Policies that Are Disabled by Default in Virtual DataPort and Solution Manager¶

In addition to the policies listed above, the administrator can enable these policies, which are disabled by default:

• Password expiration

• Lock account after many attempts to log in with the wrong password

{
   "loginPolicy": {
      "passwordExpirationConstraintConfiguration": {
         "enabled": true,
         "expirationInDays": 365
      }
   }
}

{
   "loginPolicy": {
      "lockoutConstraintConfiguration": {
            "enabled": true,
            "maxFailedAttempts": 10,
            "minutesToResetFailedAttempts": 60
      }
   }
}

{
   "loginPolicy": {
      "passwordExpirationConstraintConfiguration": {
         "enabled": true,
         "expirationInDays": 180
      },

      "lockoutConstraintConfiguration": {
            "enabled": true,
            "maxFailedAttempts": 5,
            "minutesToResetFailedAttempts": 60
      }
   }
}

ALTER USER <locked user>
    CURRENT_PASSWORD '<your administrator password>'
    UNLOCK;

When All the Administrators are Locked Out of Virtual DataPort or Solution Manager¶

If all the administrator users are locked, follow these steps:

1. Connect to the host in which Denodo Platform or Solution Manager is installed, with an account that has privileges to modify the files of the installation.

2. Edit the file <DENODO_HOME>/conf/vdp/VDBConfiguration.properties and add this property:

   userRecoveryOnStartup=<temporary password>
   

3. Restart Virtual DataPort.

4. You can now log in with a new user account: “denodo_recovery_user” that has the password indicated in the step #2.

5. Unlock your own administrator account and log out.

6. Delete the recovery account (“denodo_recovery_user”).

If in the “VDBConfiguration.properties”, you want to store the password of the recovery account encrypted, do this:

1. Execute the script <DENODO_HOME>/bin/encrypt_password to encrypt the new password.

2. In the file “VDBConfiguration.properties”, enter the password like this:

   userRecoveryOnStartup=encrypted:<encrypted password>
   

Important Notes¶

1. The password policies only affect the local user accounts of Virtual DataPort, Solution Manager, etc., and other local accounts. They do not affect users whose account is created in the Active Directory or the Identity Provider of your organization.

2. Regarding the policies that are disabled by default, if you enable them, they will only affect new accounts or to accounts whose password is changed after enabling the policy.

   For example, if you enable the policy that causes the passwords to expire after N days, only new accounts and users that change their password will be affected. For the rest, their password will be valid forever.

   Let us say you enable the policy that causes the passwords to expire and you want to enforce this policy to all the users, do this for all the user accounts:

   1. Login as an administrator and execute this command:

      DESC VQL USER "<user name>" ('includeUserPrivileges' = 'yes'
          , 'replaceExistingElements' = 'yes'
          , 'dropElements' = 'no');
      

   2. Copy the output of this command and execute it.

   3. Repeat this for each local user (to obtain all the users, execute LIST USERS).

   These steps are necessary because the policy starts to affect the account when it is recreated.