It should be possible to define some password requirements like
- min. password length
- max. password length
- password complexity (password must have numbers, characters, special characters)
- password must be renewed after x days
- password must not be the same for at least x-times
- user will be blocked after x incorrect login-attemps