While the System i operating system has very good features for controlling password selection, sometimes your password policy just can't be enforced without additional checking. You may have a list of reserved words that you specifically do not want anyone using as a password. Or, you may have some very stringent requirements that are just not covered by the system values that control password assignment in i5/OS or OS/400.
When this happens, the only solution is to code your own password validation routine. This can be coded in any high-level language. The operating system passes four parameters to your program, one of which is a single character return code. Once you've had a chance to complete your validation testing, just set the return code to the value you want and exit your program. If you set the return code to zero ('0'), then the operating system will assume that your password is acceptable and the password is updated. The parameters passed are, in order, the new password, the old password, the return code and the user profile for a total of 31 characters.
To tell the operating system that you now have your own password validation program in place, you need to update the system value "Password validation program" (QPWDVLDPGM). It is shipped from the factory set to *NONE. To use your own program, just change this value to your program name and library name. It is recommended that you store this program object in the QSYS library so that it is always saved when you backup your operating system.
Once your program is in place, test it to make sure that it is getting called. Use the CHGPWD command and intentionally use a password that will cause your routine to fail. You will see that a message is displayed indicating that the password rules are not met along with the value of the return code that you used. By varying the return code for different situations, you can give your support team a heads up as to the exact reason for the password failure.
Registering your specific program with the QPWDVLDPGM system value will only work if you are using standard 10 character user profiles and passwords. If you are using the newer long passwords, then you will have to write an exit program and register it using the exit point registration facility. If you take this path, then the QPWDVLDPGM system value must get set to the special setting of *REGFAC and the exit program is registered by the WRKREGINF command. Beware, however, that the parameters for the exit point are very different. There is a good example of the format needed for this exit program in the IBM security guide.
One thing to watch out for in this process is that the passwords, both old and new, are passed to your program without any encryption. Do not store any values received in a database file as this will compromise security on your system. In fact, you should periodically check this system value to make sure that it does not change and that the program processing additional validation rules remains unchanged. This could easily be abused on your system, so lock up the program object.
If you'd be interested in receiving a sample program for default 10 character password validation, I've written one just to test how this works on my system. Let me know and I'll send the program shell to you. If you have any questions about this topic you can reach me at (rich@kisco.com), I'll try to answer any questions you may have. All email messages will be answered.
---------------------------
About the author: Rich Loeber is president of Kisco Information Systems Inc. in Saranac Lake, N.Y. The company is a provider of various security products for the iSeries market.
