Notes

This screen answersUS-53 US-56

Acceptance criteria

As an administrator, I want to create users with a temporary password and forced first-login change, so that new accounts are onboarded securely.

Admin creates a user; system issues a temporary password (never plaintext-stored).
Forced password change on first login.
Admin can edit a user's email (the admin-only path referenced by US-51).

As an administrator, I want enforced password complexity, expiry, and reuse rules, so that user accounts meet security standards.

Enforce complexity rules (length:min 8 characters, character mix: special char, number, capital & small letter) on set/reset.
Optional expiry window configurable.
Reject reuse of the last 3 passwords.

Wireframe state

DefaultToo weak

Replace your temporary password

Your administrator gave you a temporary password. Choose your own before you continue.

Password too weak. The new password does not meet the rules below yet.

Temporary password

New password

Confirm new password

Password strengthStrong

Password strengthWeak

Save and continue