8456ch_DS_HMC_Plan.fm Draft Document for Review December 5, 2019 4:33 pm 222  IBM DS8900F Architecture and Implementation Figure 8-16 Remote Authentication Wizard Welcome page 8.5.2 Remote Authentication The following password security implementations are included: You can enable and configure remote authentication through either IBM Spectrum Control or  IBM Copy Services Manager to connect to a Lightweight Directory Access Protocol (LDAP)  repository.  With Copy Services Manager now preinstalled on the Management Console, an external  proxy is now optional. When remote authentication is enabled, the installation is guided  through by the Remote Authentication Wizard. Figure 8-16 shows the Welcome page. After  you complete all the steps of the wizard, the DS8000 is enabled and configured for remote  authentication. GLYPH<SM590000> Passwords cannot contain the user’s ID. GLYPH<SM590000> Passwords are case-sensitive. GLYPH<SM590000> The length of the password is determined by the administrator. GLYPH<SM590000> Initial passwords on new user accounts are expired. GLYPH<SM590000> Passwords that are reset by an administrator are expired. GLYPH<SM590000> Users must change expired passwords at the next logon. GLYPH<SM590000> Password rules are checked when passwords are changed. GLYPH<SM590000> The valid character set, embedded user ID, age, length, and history are also checked. GLYPH<SM590000> Passwords that are invalidated by a change remain usable until the next password  change. GLYPH<SM590000> Users with invalidated passwords are not automatically disconnected from the DS8900F. GLYPH<SM590000> The following password rules are checked when a user logs on:  – Password expiration, locked-out user , and failed attempts are checked. – Users with passwords that expire or that are locked out by the administrator while they  are logged on are not automatically disconnected from the DS8900F.