Reference: Password Standards
Single Sign-On
Single Sign-On (SSO) user account passwords aren’t stored in Workday VNDLY and are managed by your identity provider (IdP).
Workday VNDLY Password Standards
This information applies to user accounts configured to use VNDLY Login, where user account passwords are stored and managed directly in Workday VNDLY.
VNDLY Login credentials are stored in an AES-256 encrypted database using the PBKDF2 algorithm with an SHA256 hash, a password stretching mechanism recommended by the National Institute of Standards and Technology (NIST). It is outlined in NIST Special Publication 800-132 Recommendation for Password-Based Key Derivation Part 1: Storage Applications. We follow NIST recommendations for password strength as outlined in NIST Special Publication 800-63B, Digital Identity Guidelines.
Component | Description |
|---|---|
Password length | Minimum of 8 characters and configurable up to 64 characters |
Allowed characters | All printable characters allowed, including spaces |
Special characters | Permitted, but not required |
Password comparison | Workday VNDLY compares passwords to dictionaries and a list of 20,000 common, easily guessed passwords. |
Expiration period | None |
Password hints | None |
Knowledge-based authentication | None. Example: Who was your best friend in high school? |
Reauthentication | Required using configurable session timeout |
Temporary account lockout | 30 minutes after 5 invalid attempts |
Multi-factor authentication (MFA) | Configurable by user type. Example: Client, vendor, contractor. |