Skip to main content
Version: 7.2505.x.x LTS

PUK

This page lists the policy parameters specific to PUK credentials.

In addition to the policy parameters defined here, the parameters defined in the table in the chapter All credential types are also valid for PUK credentials.

maxCredFailureCount​

  • Data type: int (>0) or -1
  • Default: 3
  • Description: Maximum number of login failures before the PUK credential is definitely locked. If set to -1, the max. failure counter is disabled.

maxCredSuccessCount​

  • Data type: int (>0)
  • Default: 5
  • Description: Maximum number of successful logins before the PUK is locked.

plainValueExposedToCaller​

  • Data type: boolean
  • Default: false
  • Description: If this parameter is true, the plain value of the PUK credential will be returned by the web services or written to the returned Excel template in case of user import. Generally, we do not recommend enabling this parameter because it decreases the security of the PUK credential.

pukCharacterSet​

  • Data type: String
  • Default: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
  • Description: The characters used when generating the PUK.

pukLen​

  • Data type: int (>-1)
  • Default: 30
  • Description: Length of the generated PUK credential. It is communicated to the credential's user.

pukLifetime​

  • Data type: long (>0)
  • Default: 315360000000 (10 years in milliseconds)
  • Description: Lifetime of a PUK in milliseconds before a PUK regeneration is needed. The parameter will be read from the policy at every login, i.e., modifications to the parameter will take effect immediately.

sendingMethod​

  • Data type: Comma-separated list of enums

  • Values: any subset of PDFstore, Print, Email, HTMLemail, PDFemail, SMS_SMTP, None, or PDFstream alone

  • Default: PDFstore

  • Description: Defines a fallback list of different methods of how a credential should be communicated to the user (if the first method fails for some reason, the second is tried, and so on).

    All methods (except None) will fail if the corresponding template is missing or one or more mandatory placeholders are empty. If sendingMethod was not defined at all, nevisIDM takes the default value. The default value has no fallbacks.

    Special sendingMethod for GUI only: PDFstream — after PUK credential creation or reset, a transient link appears in the CredentialModify view on the GUI. The link can be used to download the communication PDF. If there is an error at PDF generation, the PUK's plain value will be lost, rendering the credential unusable for the owner.

    If PDFstore is configured, the following additional parameter can be defined:

    • PDFstore.destDir (optional): Defines the destination directory where the PDF is to be saved. If not configured, the directory set in nevisidm-prod.properties is used as fallback.

    If SMS_SMTP is configured, the following additional parameters must be defined:

    • SMS_SMTP.smtp.host (mandatory): Host name of the SMTP server. Availability is checked at startup.
    • SMS_SMTP.smtp.port: Port of the SMTP server.
    • SMS_SMTP.message.from (mandatory): Sender of the SMS message. Must be a valid e-mail address.
    • SMS_SMTP.message.to (mandatory): Receiver of the SMS message. Must contain the ${phonenumber} placeholder. Example: ${phonenumber}@sms.mycompany.ch.
    • SMS_SMTP.message.subject (mandatory): Subject of the e-mail sent to the SMTP gateway.

    The PDFemail method requires two templates: one e-mail and one OpenOffice template. If PDFemail is configured, the following additional parameter can be defined:

    • PDFemail.htmlEmail (optional, default: false): If true, an HTML e-mail is sent. Otherwise, a plain text e-mail is sent.

templatePrecedence​

  • Data type: int
  • Default: null
  • Description: The precedence number of the template to use during the communication with the user. If the parameter is not set, the default template will be used. If no template exists with the given precedence number, an error will occur.

tmpLockingDuration​

  • Data type: long
  • Default: 60000
  • Description: Duration of the temporary locking in milliseconds. Use a tmpLockingDuration of at least 30000 since the exact duration cannot be guaranteed below this value.

tmpLockingMode​

  • Data type: String
  • Values: strict, threshold
  • Default: strict
  • Description:
    • strict: when the first temporary locking period is over, the user can try to log in only once before the next temporary locking period activates.
    • threshold: the user can always try tmpLockingThreshold times to log in before the next temporary locking period activates.

tmpLockingThreshold​

  • Data type: int
  • Default: 2
  • Description: Number of login failures before the PUK credential is temporarily locked. If set to -1, the temporary lock is disabled.