Product SiteDocumentation Site

11.5. Changing the Priority of Group Password Policies

A user may belong to multiple groups, each with different password policies. Since only one policy can be in effect for a user, there has to be a method to assign precedence to policies. That is done through priority.
The highest priority is zero (0). The lower the number, the higher the priority.
This is set initially when the password policy is created. It can be modified after the policy is created by resetting the --priority option.
$ ipa pwpolicy-mod examplegroup --priority=10
When a user belongs to multiple groups, the group password policy with the lowest number has the priority.


The password policy priority cannot be changed in the UI after it is created.