Problem statement
This article will explain how to force users to change their password after several days have elapsed. For example, they must change their password every 90 days.
Solution
An action that can force password rotation has been introduced.
NOTE: This facility is limited only to users who belong to Auth0 database connections . Users associated with other types of connections ( e.g., Enterprise connections and social providers such as Google ) have individual mechanisms to manage user passwords.
Choosing this option will help to increase the security posture of tenant applications. The Action can be used with the Password History setting available to Auth0 database connections. The intention of this policy is to:
- Force users to change their password at predefined intervals ( e.g., 60 days ).
- Prevent users from re-using passwords that have previously been used.
For more information, refer to Password Options in Auth0 Database Connections.
Add the Auth0 Action
NOTE: It is strongly recommended that Actions be first developed and tested in a Development tenant before being deployed to a Production environment. For more information, refer to Set Up Multiple Environments.
- Login to the dashboard as a tenant administrator ( Member ).
- Navigate Actions > Library.
- Click Create Action: a drop-down list will appear.
- Select the option Use a Marketplace Integration.
- A window will appear that provides the facility to browse or search for pre-built Actions: in the search box, type “Password Rotation.”
- Click Password Rotation to access the installation screen.
- Click Installation.
- Read and understand the information about the Password Rotation action.
- Click Add Integration.
- Click Continue.
- Configure the Action with the desired expiration period ( in days ) and the error message.
- Click Create.
- The Password Rotation action will be installed.
Associate the action with a Flow
Once installed, the action must be associated with a Login flow.
- Navigate Actions > Flows.
- Click Login.
Password Rotation ( seen here on the right-hand side of the screen ) is active and associated with the Login flow.
An alternative solution that uses Rules
NOTE: Beginning October 16th, 2023, Rules & Hooks will no longer be available to new tenants. Actions is our offering, which unifies all the extensibility of Rules and Hooks and more. For existing users of Rules & Hooks, these features will no longer be available as of November 18th, 2024.
Using a Rule, it is possible to check when a user’s password was last reset, as described in this Check-Last-Password-Reset code sample. However, this method just blocks the login attempt. A better user experience is to use this approach in combination with logic for checking when the password was last reset, then force a change of password. For more information, refer to the sample code in Force-Password-Change-Example.