action dracoon_request_password_policies_config {
  label: "Request password policies"
  description: "<h3 style='padding: 5px; background-color: #F6F7F8; border: 1px solid #AAA; border-radius: 5px; display: table-cell;'>&#128640; Since v4.14.0</h3>\n\n### Description:  \nRetrieve a list of configured password policies for all password types:  \n* `login`\n* `shares`\n* `encryption`\n\n### Precondition:\nRight <span style='padding: 3px; background-color: #F6F7F8; border: 1px solid #000; border-radius: 5px; display: inline;'>&#128275; read global config</span> and\nrole <span style='padding: 3px; background-color: #F6F7F8; border: 1px solid #000; border-radius: 5px; display: inline;'>&#128100; Config Manager</span> of the Provider Customer required.\n\n### Postcondition:\nList of configured password policies is returned.\n\n### Further Information:\nNone.\n\n### Available password policies:\n<details style=\"padding: 10px; background-color: #F6F7F8; border: 1px solid #AAA; border-radius: 5px;\">\n<summary style=\"cursor: pointer; outline: none\"><strong>Expand</strong></summary>\n\n| Name | Description | Value | Password Type |\n| :--- | :--- | :--- | :--- |\n| `mustContainCharacters` | Characters which a password must contain:<br><ul><li>`alpha` - at least one alphabetical character (`uppercase` **OR** `lowercase`)<pre>a b c d e f g h i j k l m n o p q r s t u v w x y z<br>A B C D E F G H I J K L M N O P Q R S T U V W X Y Z</pre></li><li>`uppercase` - at least one uppercase character<pre>A B C D E F G H I J K L M N O P Q R S T U V W X Y Z</pre></li><li>`lowercase` - at least one lowercase character<pre>a b c d e f g h i j k l m n o p q r s t u v w x y z</pre></li><li>`numeric` - at least one numeric character<pre>0 1 2 3 4 5 6 7 8 9</pre></li><li>`special` - at least one special character (letters and digits excluded)<pre>! \" # $ % ( ) * + , - . / : ; = ? @ [ \\ ] ^ _ { &#124; } ~</pre></li><li>`none` - none of the above</li></ul> | <ul><li>`alpha`</li><li>`uppercase`</li><li>`lowercase`</li><li>`numeric`</li><li>`special`</li><li>`none`</li></ul> | <ul><li>`login`</li><li>`shares`</li><li>`encryption`</li></ul> |\n| `numberOfCharacteristicsToEnforce` | Number of characteristics to enforce.<br>e.g. from `[\"uppercase\", \"lowercase\", \"numeric\", \"special\"]`<br>all 4 character sets can be enforced; but also only 2 of them | `Integer between 0 and 4` | <ul><li>`login`</li><li>`shares`</li><li>`encryption`</li></ul> |\n| `minLength` | Minimum number of characters a password must contain. | `Integer between 1 and 1024` | <ul><li>`login`</li><li>`shares`</li><li>`encryption`</li></ul> |\n| `rejectDictionaryWords` | Determines whether a password must **NOT** contain word(s) from a dictionary.<br>In `core-service.properties` a path to directory with dictionary files (`*.txt`) can be defined<br>cf. `policies.passwords.dictionary.directory`.<br><br>If this rule gets enabled `policies.passwords.dictionary.directory` must be defined and contain dictionary files.<br>Otherwise, the rule will not have any effect on password validation process. | `true or false` | <ul><li>`login`</li><li>`shares`</li></ul> |\n| `rejectUserInfo` | Determines whether a password must **NOT** contain user info.<br>Affects user's **first name**, **last name**, **email** and **user name**. | `true or false` | <ul><li>`login`</li><li>`shares`</li><li>`encryption`</li></ul> |\n| `rejectKeyboardPatterns` | Determines whether a password must **NOT** contain keyboard patterns.<br>e.g. `qwertz`, `asdf` (min. 4 character pattern) | `true or false` | <ul><li>`login`</li><li>`shares`</li><li>`encryption`</li></ul> |\n| `numberOfArchivedPasswords` | Number of passwords to archive.<br>Value `0` means that password history is disabled. | `Integer between 0 and 10` | <ul><li>`login`</li></ul> |\n| `passwordExpiration.enabled` | Determines whether password expiration is enabled. | `true or false` | <ul><li>`login`</li></ul> |\n| `maxPasswordAge` | Maximum allowed password age (in **days**) | `positive Integer` | <ul><li>`login`</li></ul> |\n| `userLockout.enabled` | Determines whether user lockout is enabled. | `true or false` | <ul><li>`login`</li></ul> |\n| `maxNumberOfLoginFailures` | Maximum allowed number of failed login attempts. | `positive Integer` | <ul><li>`login`</li></ul> |\n| `lockoutPeriod` | Amount of **minutes** a user has to wait to make another login attempt<br>after `maxNumberOfLoginFailures` has been exceeded. | `positive Integer` | <ul><li>`login`</li></ul> |\n\n</details>"
  provider: dracoon
  method: GET
  path: "/v4/system/config/policies/passwords"
  encoding: json
  input: {
    type: "object"
    properties: {
      "X-Sds-Auth-Token": {
        type: "string"
      }
    }
    additionalProperties: false
  }
  output: {
    type: "object"
    description: "Set of password policies"
    properties: {
      encryptionPasswordPolicies: {
        type: "object"
        description: "Encryption password policies"
        properties: {
          characterRules: {
            type: "object"
            description: "Password character rules"
            required: ["mustContainCharacters", "numberOfCharacteristicsToEnforce"]
            properties: {
              mustContainCharacters: {
                type: "array"
                description: "Characters which a password must contain:\n\n* `alpha` - at least one alphabetical character (`uppercase` OR `lowercase`)\n\n* `uppercase` - at least one uppercase character\n\n* `lowercase` - at least one lowercase character\n\n* `numeric` - at least one numeric character\n\n* `special` - at least one special character (letters and digits excluded)\n\n* `all` - combination of `uppercase`, `lowercase`, `numeric` and `special` (available only in request models)\n\n* `none` - none of the above"
                enum: ["alpha", "uppercase", "lowercase", "numeric", "special", "all", "none"]
                items: {
                  type: "string"
                  description: "Characters which a password must contain:\n\n* `alpha` - at least one alphabetical character (`uppercase` OR `lowercase`)\n\n* `uppercase` - at least one uppercase character\n\n* `lowercase` - at least one lowercase character\n\n* `numeric` - at least one numeric character\n\n* `special` - at least one special character (letters and digits excluded)\n\n* `all` - combination of `uppercase`, `lowercase`, `numeric` and `special` (available only in request models)\n\n* `none` - none of the above"
                  enum: ["alpha", "uppercase", "lowercase", "numeric", "special", "all", "none"]
                }
              }
              numberOfCharacteristicsToEnforce: {
                type: "integer"
                format: "int32"
                description: "Number of characteristics to enforce\n\ne.g. from `[\"uppercase\", \"lowercase\", \"numeric\", \"special\"]`\n\nall 4 character sets can be enforced; but also only 2 of them"
              }
            }
          }
          minLength: {
            type: "integer"
            format: "int32"
            description: "Minimum number of characters a password must contain"
          }
          rejectKeyboardPatterns: {
            type: "boolean"
            description: "Determines whether a password must NOT contain keyboard patterns (e.g. `qwertz`, `asdf`)\n\n(min. 4 character pattern)"
          }
          rejectUserInfo: {
            type: "boolean"
            description: "Determines whether a password must NOT contain user info (first name, last name, email, user name)"
          }
          updatedAt: {
            type: "string"
            format: "date-time"
            description: "Modification date"
          }
          updatedBy: {
            type: "object"
            description: "User information"
            required: ["avatarUuid", "firstName", "id", "lastName", "userName", "userType"]
            properties: {
              avatarUuid: {
                type: "string"
                description: "&#128640; Since v4.11.0\n\nAvatar UUID"
              }
              displayName: {
                type: "string"
                description: "&#128679; Deprecated since v4.11.0\n\nDisplay name\n\nuse other fields from `UserInfo` instead to combine a display name"
              }
              email: {
                type: "string"
                description: "&#128640; Since v4.11.0\n\nEmail "
              }
              firstName: {
                type: "string"
                description: "&#128640; Since v4.11.0\n\nUser first name (mandatory if `userType` is `internal`)"
              }
              id: {
                type: "integer"
                format: "int64"
                description: "Unique identifier for the user"
              }
              lastName: {
                type: "string"
                description: "&#128640; Since v4.11.0\n\nUser last name (mandatory if `userType` is `internal`)"
              }
              title: {
                type: "string"
                description: "&#128679; Deprecated since v4.18.0\n\nJob title"
              }
              userName: {
                type: "string"
                description: "&#128640; Since v4.13.0\n\nUsername (only returned for `internal` users)"
              }
              userType: {
                type: "string"
                description: "&#128640; Since v4.11.0\n\nUser type:\n\n* `internal` - ordinary DRACOON user\n\n* `external` - external user without DRACOON account\n\n* `system` - system user (non human &#128125;)\n\n* `deleted` - deleted DRACOON user"
                enum: ["system", "internal", "external", "deleted"]
              }
            }
          }
        }
      }
      loginPasswordPolicies: {
        type: "object"
        description: "Login password policies"
        required: ["characterRules", "minLength", "numberOfArchivedPasswords", "passwordExpiration", "rejectDictionaryWords", "rejectKeyboardPatterns", "rejectUserInfo", "updatedAt", "updatedBy", "userLockout"]
        properties: {
          characterRules: {
            type: "object"
            additionalProperties: true
          }
          minLength: {
            type: "integer"
            format: "int32"
            description: "Minimum number of characters a password must contain"
          }
          numberOfArchivedPasswords: {
            type: "integer"
            format: "int32"
            description: "Number of passwords to archive\n\n(must be between `0` and `10`; `0` means that password history is disabled)"
          }
          passwordExpiration: {
            type: "object"
            description: "Password expiration information"
            required: ["enabled"]
            properties: {
              enabled: {
                type: "boolean"
                description: "Determines whether password expiration is enabled"
              }
              maxPasswordAge: {
                type: "integer"
                format: "int32"
                description: "Maximum allowed password age (in days)"
              }
            }
          }
          rejectDictionaryWords: {
            type: "boolean"
            description: "Determines whether a password must NOT contain word(s) from a dictionary"
          }
          rejectKeyboardPatterns: {
            type: "boolean"
            description: "Determines whether a password must NOT contain keyboard patterns (e.g. `qwertz`, `asdf`)\n\n(min. 4 character pattern)"
          }
          rejectUserInfo: {
            type: "boolean"
            description: "Determines whether a password must NOT contain user info (first name, last name, email, user name)"
          }
          updatedAt: {
            type: "string"
            format: "date-time"
            description: "Modification date"
          }
          updatedBy: {
            type: "object"
            additionalProperties: true
          }
          userLockout: {
            type: "object"
            description: "User lockout information"
            required: ["enabled"]
            properties: {
              enabled: {
                type: "boolean"
                description: "Determines whether user lockout is enabled"
              }
              lockoutPeriod: {
                type: "integer"
                format: "int32"
                description: "Amount of minutes a user has to wait to make another login attempt after `maxNumberOfLoginFailures` has been exceeded"
              }
              maxNumberOfLoginFailures: {
                type: "integer"
                format: "int32"
                description: "Maximum allowed number of failed login attempts"
              }
            }
          }
        }
      }
      sharesPasswordPolicies: {
        type: "object"
        description: "Shares password policies"
        properties: {
          characterRules: {
            type: "object"
            additionalProperties: true
          }
          minLength: {
            type: "integer"
            format: "int32"
            description: "Minimum number of characters a password must contain"
          }
          rejectDictionaryWords: {
            type: "boolean"
            description: "Determines whether a password must NOT contain word(s) from a dictionary"
          }
          rejectKeyboardPatterns: {
            type: "boolean"
            description: "Determines whether a password must NOT contain keyboard patterns (e.g. `qwertz`, `asdf`)\n\n(min. 4 character pattern)"
          }
          rejectUserInfo: {
            type: "boolean"
            description: "Determines whether a password must NOT contain user info (first name, last name, email, user name)"
          }
          updatedAt: {
            type: "string"
            format: "date-time"
            description: "Modification date"
          }
          updatedBy: {
            type: "object"
            additionalProperties: true
          }
        }
      }
    }
  }
}