# Password policies not enforced for federated user's password change

**URL:** <https://forum.keycloak.org/t/password-policies-not-enforced-for-federated-users-password-change/4688>\
**Category:** Configuring the server\
**Created:** [September 3, 2020, 12:34pm UTC](https://forum.keycloak.org/t/password-policies-not-enforced-for-federated-users-password-change/4688 "2020-09-03T12:34:20Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![fschmtt](https://avatars.discourse-cdn.com/v4/letter/f/a88e4f/32.png) [@fschmtt](https://forum.keycloak.org/u/fschmtt)\
**Post date:** [September 3, 2020, 12:34pm UTC](https://forum.keycloak.org/t/password-policies-not-enforced-for-federated-users-password-change/4688/1 "2020-09-03T12:34:20Z")

</div>

Hi,

we’re using a custom User Federation (implementing the User Storage SPI). User registrations are possible and configured Password Policies are enforced (e. g. “Minimum Length = 8”) when the registration form is validated (we are using a custom registration flow too).

But when a logged-in user wants to update their password via the “account” client (/auth/realms/{realm}/account/password) the configured Password Policies for this realm are not enforced.

Is there some setting that I am missing?