The Security Enhanced Directory Manager features enhanced security and control on user management. 

Once you have configured SEDM you will gain access to these features : 

• • Password policy
  • Account Timeout & Lockout
  • Account Recovery via email
  • End user have option to enable MFA, if SEDM configured to enable such MFA plugin
    
    
• SEDM acts as middle layer before talking to Directory Manager
  • Defaults to referring to Joget users
  • Can be configured to also communicate with LDAP / Sync LDAP / other DM (Directory Manager) plugins and many more.
    
    

Once SEDM is configured, stronger password encryption for local accounts will take over. (Security Enhanced Directory Manager uses the SHA 256 encryption to store the password._

Be careful when disabling SEDM plugin, as this will cause all local passwords to be invalid. See here for Disabling Plugin

Enabling Plugin

Simply go to System Settings -> Directory Manager Settings to enable and configure.

Once the plugin is enabled, users' password would be stored using a new encryption method. Disabling the plugin would cause all the users not to be able to login anymore as the default encryption method is effectively changed.If you decide to stop using the plugin, you will need to replace all the affected users' password in dir_user table with a new password based on md5 hash

Security Enhanced Directory Manager uses the SHA 256 encryption to store the password.

For example, the old standard encrypted hash for "User@123" is "448ddd517d3abb70045aea6929f02367" using MD5.
When you change the Joget directory manager to use SEDM, the new password becomes something like "@@@@whateverhashencryption@@@@". 

If you then later remove/disable the SEDM plugin, the password is unchanged at SHA 256 encryption. Because the SEDM is not in play anymore, Joget is unable to authenticate the username because it is expecting the password to be the old MD5 encryption.

Do note that passwords once changed to the new SHA 256 Encryption cannot be changed back to MD5.

If you decide you don't want to use SEDM and then delete the plugin setting, you will need to use your database backups to restore the table "dir_user" to revert back to the original passwords (using MD5 and before SEDM was implemented).

You can also run the following query to update the "dir_user" table back to the old password - An example of the SQL query is as follows:

UPDATE dir_user SET password = '5f4dcc3b5aa765d61d8327deb882cf99' WHERE id = 'username'

The "5f4dcc3b5aa765d61d8327deb882cf99" value is the word "password" using the old encryption.

Setting up the Notification tab in this Enhanced Security Directory Manager is important and highly recommended. Do not skip the setup and remember to test sending email out to make sure that the email server settings is correct.

Figure 2: Notification tab