Pricing  Get Quote
 

Knowledge Base

Self Service Password Management » Knowledge Base

Writing regex patterns for the Password Policy Enforcer

ADSelfService Plus' Password Policy Enforcer provides several granular settings to ensure that your users choose strong passwords that meet your organization's password policy and achieve compliance with regulatory norms. It also enables you to enforce custom password formats using regex patterns.

This webpage helps you understand what regex patterns are and how you can use them to enforce custom password formats in your organization.

What is a regex?

A Regular Expression (or regex) is a pattern used to refer to a set of strings that match the criteria it defines while rejecting ones that don't match.

A regex is composed of a sequence of characters and meta characters (such as ., \d, \D, \s, \S, \w, \W), and operators (such as +, *, ?, |, ^). These elements are combined to create expressions that can be integrated to form complex patterns.

Regex elements

Regex literals: Regex literals are characters or sequences that represent the exact characters or sequences of characters you want to ensure in the password. For example, if you want to ensure a password contains the literal string "J0m95" , you could use the regex J0m95. This pattern will only allow passwords that include "J0m95' exactly as written.

Regex metacharacters: Metacharacters are regex sequences that have special defined meanings in regexes. Their definitions and meanings are listed in the tables below.

You can use any character in a literal except for metacharacters. To use metacharacters in a regex literal, you will need to include a backslash before it. For example, if you want to ensure a password contains the literal string "J0m95$", you could use the regex J0m95\$. Including the backslash before "$" will cause the character to be rendered literally, ensuring this pattern will only allow passwords that include "J0m95$" exactly as written.

Note: Regex elements are case-sensitive.

By combining literals with other regex metacharacters, you can create a wide variety of precise patterns that user passwords must match. The most commonly used metacharacters with their meanings are listed in the table below.

Special Character Metacharacter Meaning Examples
Caret ^ Specifies that the password must start with the character that follows The regex ^d mandates the password to start with the alphabet d, such as data or deer
Dollar Sign $ Specifies that the password must end with the character that precedes it The regex a$ mandates the password to end with the alphabet a, such as alpha or beta
Dot . Allows any character in its place except for a newline character The regex a.b allows the password to contain a1b, acb, or a b but not ab
Asterisk * Allows 0 or more occurrences of the preceding element The regex ab*c allows the password to contain ac, abc, abbc, etc
Plus + Requires 1 or more occurrences of the preceding element The regex ab+c requires the password to contain at least one instance of the alphabet b between a and c, such as abc or abbc, but not ac
Question Mark ? Allows 0 or 1 occurrence of the preceding element The regex ab?c allows the password to contain ac or abc, but not abbc, abbbc, etc
Curly Braces {n} Requires the preceding character to appear exactly n times (with no prohibition on more times) The regex Data{3} mandates that the password must contain Dataaa
{n,} Requires the preceding character to appear at least n times (i.e., with no upper limit) The regex Data{1,} indicates that the password can contain Data, Dataa, Dataaa, and so on
{n,m} Mandates the minimum and maximum number of times the preceding element should appear. The regex Data{1,2} indicates that the password can contain Data and Dataa, but not Dataaa
Parentheses () Groups multiple tokens together The regex (abc)+ allows multiple instances of abc such as abc, abcabc, abcabcabc, etc
Pipe | Specifies alternatives (logical OR) The regex dat(a|e|o) will allow data, date, and dato
Backslash \ Escapes a special character that has a regex meaning otherwise The regex \. mandates a literal dot instead of the regex usage for a dot, which is a placeholder
Digit \d Requires any digit The regex \d mandates the password to contain a number between 0-9
Non-Digit \D Requires any non-digit The regex \D requires the password to contain any character other than 0-9
Whitespace \s Requires any whitespace character The regex \s requires the password to contain a space, a tab, or a newline character
Non-Whitespace \S Requires any non-whitespace character The regex \S mandates the password to have a character other than a space, a tab, or a newline character
Word Character \w Requires any word character (alphanumeric + underscore) The regex \w mandates a string containing any combination of a-z, A-Z, 0-9, and _
Non-Word Character \W Requires any non-word character The regex \W mandates any string without any combination of a-z, A-Z, 0-9, and _
Character Class [a-m] It represents any character within the specified range The regex Dat[a-f] will allow both Data and Date but not Dato
[^a] If ^ is used along with square brackets, it represents any character but the one mentioned The regex Dat[^e] will allow both Data and Dato but not Date
[abc] Allows any one of the characters a, b, or c The regex [abc] allows a , b , or c
[^abc] Matches any character except a, b, or c Denotes that the password must not contain the characters a, b, or c
Hyphen [a-z] Matches any character from a to z Denotes that the password can contain any of the alphabets from a to z

Using just the elements in the table above will mandate the password to be in the exact format as the regex. However, if you want certain conditions to be met with a degree of flexibility (for example, if you want the password to contain an asterisk without specifying if it should be in the beginning, middle, or end), you can use the assertion (condition) elements in the following table to ensure that the condition specified is met in the password.

Special Character Metacharacter Meaning Examples
Non-Capturing Group (?: ... ) Groups multiple tokens together without making them available for regex capturing The regex (?:[A-Za-z]\d){2} mandates that the password contains two sequences of a letter followed by a digit, such as A1b2
Positive Lookahead (?= ... ) Ensures that what follows the position satisfies the condition The regex (?=.*[A-Z]) mandates that the password contains at least one uppercase letter
Negative Lookahead (?! ... ) Ensures that what follows the position does not satisfy the condition The regex (?!.*\s) mandates that the password does not contain any whitespace characters
Positive Lookbehind (?<= ... ) Ensures that what precedes the position satisfies the condition The regex (?<=@)\w+ mandates that the password contains a word character sequence following an @
Negative Lookbehind (?<! ... ) Ensures that what precedes the position does not satisfy the condition The regex (?<!@)\w+ mandates that the password contains a word character sequence that does not follow an @

Combining regex elements to write regexes

Now, let us combine the elements in the tables above to learn how to write regexes.

Example 1

To ensure the password has at least eight characters, the regex code is

^.{8,}$

Explanation

  • ^: Start of the string.
  • .{8,}: At least eight characters (any character except newline characters).
  • $: End of the string.

Example 2

To ensure the password has at least three asterisk characters, the regex code is

^(.*\*.*){3}$

Explanation

  • ^: Start of the string.
  • (.*\*.*): At least one asterisk
  • {3}: Repeated thrice
  • $: End of the string.

Example 3

To ensure the password has at least one special character (such as !@#$%^&*), the regex code is

^(?=.*[!@#$%^&*]).*$

Explanation

  • ^: Start of the string.
  • (?=.*[!@#$%^&*]): At least one of the special characters mentioned
  • .*:More characters if required
  • $: End of the string.

Example 4 (Combining multiple regexes)

Now, let us see how to combine examples 1 and 3 to form a regex pattern to ensure that passwords are at least eight characters long, including at least one special character.

^(?=.*[!@#$%^&*]).*.{8,})$

Explanation

  • ^: Start of the string.
  • (?=.*[!@#$%^&*]): At least one of the special characters mentioned
  • .*:More characters if required
  • .{8,}): At least eight characters (any character except newline characters).
  • $: End of the string.

You can now use the information in this page to write regexes that user passwords must adhere to. For detailed instructions on how to configure this in ADSelfService Plus, click here .

Additional resources:
  • Regexr is an online tool to learn, build, and test regular expressions. It offers a searchable database of patterns submitted by its online peer community.
  • Regexlib is a library of the most commonly used regexes.
  • Regular-expressions.info provides a wide range of in-depth information for constructing a regex.
  • Regex101 is an online regex tester and debugger for evaluating your regexes.

Request for Support

Need further assistance? Fill this form, and we'll contact you rightaway.

  • Name
  •  
  • Business Email *
  •  
  • Phone *
  •  
  • Problem Description *
  •  
  • Country
  •  
  • By clicking 'Submit' you agree to processing of personal data according to the Privacy Policy.
Highlights of ADSelfService Plus

Password self-service

Allow Active Directory users to self-service their password resets and account unlock tasks, freeing them from lengthy help desk calls.

One identity with single sign-on

Get seamless one-click access to 100+ cloud applications. With enterprise single sign-on, users can access all their cloud applications using their Active Directory credentials.

Password and account expiry notification

Intimate Active Directory users of their impending password and account expiry via email and SMS notifications.

Password synchronization

Synchronize Windows Active Directory user passwords and account changes across multiple systems automatically, including Microsoft 365, Google Workspace, IBM iSeries, and more.

Password policy enforcer

Strong passwords resist various hacking threats. Enforce Active Directory users to adhere to compliant passwords by displaying password complexity requirements.

Directory self-update and corporate directory search

Enable Active Directory users to update their latest information themselves. Quick search features help admins scout for information using search keys like contact numbers.

« Home
Knowledge Base »

ADSelfService Plus trusted by

Embark on a journey towards identity security and Zero Trust
Password management Adaptive MFA Enterprise SSO Self-service & security Related products
 
Back to Top