# 4.16 Password Invalidator Authentication

**Introduction**

The **Password Invalidator** is a feature in ZTrust that helps keep user accounts secure. It automatically **forces users to change their login passwords** after a **predefined time period**.\
This ensures that **weak, old, or compromised passwords** are regularly updated, keeping your organization's data safe.

**Why Use Password Invalidator? (Use Cases)**

1. Admin defines a **password validity period** (e.g., 30 days, 45 days, 60 days).&#x20;
2. When the period ends, the **Password Invalidator** forces the user to **reset their password** on the next login.&#x20;
3. Set up warning emails to notify users before their password expires, so they can be aware and update their password on time.

* **Enhanced Security**
  * The system makes you **change your password regularly** so that old or weak passwords don’t put your account at risk.
* **Compliance with Company Policies**
  * Some organizations **require** you to change your password after a certain time.
  * This feature **automatically enforces** those rules.
* **Reduce Unauthorized Access Risks**
  * If someone manages to steal your password, they can’t use it for long because it will **expire** after the set time.
* **Warning Notifications**
  * You’ll receive **notifications** before your password expires, so you have time to **update it without being locked out**.

**Step 1 – Login to ZTrust Admin Console**

* Open your **ZTrust Admin Console** in your browser.
* Sign in with your **admin credentials**.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FWmsnHXNL4bJCesrGmYpK%2Fimage.png?alt=media&#x26;token=7821840e-6c11-41a3-846e-34b76c36c17f" alt=""><figcaption><p>Fig. 4.16.a: Welcome page of customer_demo realm</p></figcaption></figure>

**Step 2 – Enable Password Invalidator in Events**

* Navigate to **Realm Settings** → **Events**.
* In the **Event Listener** dropdown, **select** `password-invalidation`.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FFQD8PqnkalxXv2tvc9g3%2Fimage.png?alt=media&#x26;token=4d5e84cf-fe87-4168-98ca-1ae79441402e" alt=""><figcaption><p>Fig. 4.16.b: Navigating to Realm Settings ⇒ Events and adding 'password_invalidation' to event listeners</p></figcaption></figure>

**Step 3 – Configure the Scheduler & Notifications**

* Go to **Realm Settings** → **Authentication**.
* Go to **Policies Tab → Password Policy**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FA7Xpimkl3A4bVblvAhG7%2Fimage.png?alt=media&#x26;token=629ca961-77ad-45d3-8dec-b6689437918a" alt=""><figcaption><p>Fig. 4.16.c: Navigating to Authentication ⇒ Policies ⇒ Password Policy</p></figcaption></figure>

* In **Password Invalidator** execution: Click on Add policy and define the required policy
* Set the **password expiry duration** (e.g., 30 days, 45 days).
* Set the **Minimum length**, **Maximum length**, **Special characters**, **Digit**, **Uppercase** and **Lowercase** and the policy to secured their password.

**Step 4 – Create a Custom Authentication Flow**

* Go to **Realm Settings** → **Authentication**.
* Click on the **Flows** tab.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2F8qhoe8tL9ocZTfCVFkOz%2Fimage.png?alt=media&#x26;token=bde1df1f-4289-4199-9f8e-c9af728cded7" alt=""><figcaption><p>Fig. 4.16.d: Navigating to Authentication ⇒ Flows and duplicate browser form</p></figcaption></figure>

* Create a **duplicate** in **browser flow** → Name "**password invalidator notification**" an click on Duplicate

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FJwkcSxhIbM9GD0BBaG7w%2Fimage.png?alt=media&#x26;token=d93bf9b3-9cba-470b-b7e9-71e0cead3718" alt=""><figcaption><p>Fig. 4.16.e: Duplicating the browser flow for Password Invalidation notification</p></figcaption></figure>

* Click on Add execution and find **Password Invalidator** from the execution

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FxgsjaxJJvPEHcd8Hgpj0%2Fimage.png?alt=media&#x26;token=5597b31c-b168-4451-a682-28b9222c438a" alt=""><figcaption><p>Fig. 4.16.f: Add 'Advanced Password Invalidator' execution</p></figcaption></figure>

* Add the **Password Invalidator** execution step.
* Mark it as **Required**.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FQqFraoo6kZi0pdkFXBQh%2Fimage.png?alt=media&#x26;token=f044f768-34f7-4dc7-8cd2-7142fa1563d5" alt=""><figcaption><p>Fig. 4.16.g: Change the 'Requirement' for 'password invalidator notifications forms'</p></figcaption></figure>

**Step 5 – Configure the Scheduler & Notifications**

Here admin need to set up the following fields:

* **Alias** → A unique name for this configuration.
* **Authenticator Reference** → Optional reference name if needed.
* **Authenticator Reference Max Age** → Maximum validity period for the authenticator.
* **Configure Scheduler** → Turn ON/OFF to start and stop the Password Invalidator Notification.
* **Notification Before Password Expiry** → Select the days before password expiry to send a notification.
* **Duration to send notification** → Select the Time format for sending Notifications.

Once the policy is configured, click on **Save**. The system will then start checking password expiry for all existing users.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2Fn7dnFy4YY9rP3A1xx0Qg%2Fimage.png?alt=media&#x26;token=307734f8-a2e5-47f2-b656-f53905780875" alt=""><figcaption><p>Fig. 4.16.h: Configuration for Password Invalidation Notification</p></figcaption></figure>

**Step 6 - Bind the flow to work in Browser flow**

* After setting up the password invalidator flow, bind it to the Browser flow.
* This ensures that the system will check password expiry whenever users log in through the browser.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FINOlbb2EafNNAOK5zLnt%2Fimage.png?alt=media&#x26;token=605fb20c-e19d-493e-98fa-d1cb15c4c925" alt=""><figcaption><p>Fig. 4.16.i: Proceeding to bind the password invalidator notification flow</p></figcaption></figure>

**Example Scenarios:**&#x20;

* Scenario 1: Corporate Security Policy
  * **Requirement:** Change passwords every **60 days**.
  * **Solution:** Configure Password Invalidator for **60 days** and enable **7-day warnings**.
* Scenario 2: High-Security Applications
  * **Requirement:** Enforce strict password rules.
  * **Solution:**
    * Set expiry to **30 days**.
    * Require **12-character passwords**.
    * Enforce **password history** to avoid reuse.
* Scenario 3: User Experience Optimization
  * **Requirement:** Notify users early to reduce login issues.
  * **Solution:** Enable **email reminders** **10 days before expiry**.

    \\
