D2L user password requirements

Question

Are there any hard password requirements when setting a user's D2L Password via the Valence API?

Through trial & error we've discovered there is an 8-character minimum, which matches the message in the GUI: "Password must be between 8 and 50 characters in length."

Is that the only hard requirement or are there others? (alphanumeric, capitalization, no repeats, etc.)

Answer 1

The site administrator for the back-end Learning Service can specify the form a valid password must take (including allowed characters, length, and so forth) with the DOME variables found in the Auth>Password cluster of settings. The configured validation rules are not exposed through the Learning Framework APIs, so you will need to ask your site administrator if passwords have any rules about their form.

If you attempt an API call to update a user's password, and the password provided has an invalid form, the service will respond with an Invalid Request (400) error, but you likely won't get any further information about what form would be a valid one.

Accordingly, if you're writing a mobile client app, your app should likely tell the user to "contact the LMS system administrator for more information on what makes a valid password" or similar.