62

I'm interested in finding out what people's experiences with standard usernames is. I've always been in places that used {firstInitial}{lastname} (sometimes with a length-limit). Now I've users that want {firstname}.{lastname} - and now it comes up that the period may cause problems.

Specifically:

  • What is the best username length limit to use to maintain compatibility across all uses?
  • What characters should be avoided?

UPDATE: The reason I didn't mention specifics is that I wanted to be general enough to handle anything that might come up in the future. However, that may be too general of a requirement (anything can happen, right?).

This is our environment: Ubuntu Server Lucid Lynx 10.04 LTS, Red Hat Enterprise Linux 5.6 and up, Windows Server 2003 and Windows 2000 Server (with Active Directory in Windows 2000 Native Mode), Zimbra 7.x for mail, and OpenLDAP in the near future.

UPDATE: I should mention (for completeness) that I saw this question (though it didn't answer my asked question) and also this web post, both of which were very informative.

Community
  • 1
Mei
  • 4,560
  • 8
  • 44
  • 53
  • 4
    You did not mention the operating system/application. Do you want to make it too general to be applied to any OS/app? – Khaled Jan 11 '12 at 16:37
  • 13
    Our company of 80,000 used the standard of {firstInitial}{lastname} for login and email address. We changed things up after an angry call from Mr. Thomas Watts whose email was getting blocked by our firewall. Have enough people and there will be a problem. – MaskedPlant Jan 11 '12 at 16:42
  • 13
    @MaskedPlant: I love funny usernames. We had a Customer once who used an IBM RACFID standard of "first four characters of last name, first initial, middle initial". "Susan Penington" wasn't happy with this, as you can imagine. Nor was "Mary Utt" happy with first initial / last name at another site... >smile – Evan Anderson Jan 11 '12 at 16:50
  • Good one Evan - reminded me of something to put into my answer below. – mfinni Jan 11 '12 at 17:01
  • My opinion is that you should employ whatever naming convention is practical, acceptable, and appropriate. Whether or not there's actually a best practice for this is debatable. There may be claims to a best practice but at the end of the day it's really just someone's opinion (but often rooted in practical application). – joeqwerty Jan 11 '12 at 17:03
  • 4
    {first initial}{last name} seems to be the most common and is relatively safe for small and medium biz. Makes the sales dept lives much easier to have a common convention in place when making those phone calls and talking B2B. – Chad Harrison Jan 11 '12 at 17:43
  • possible duplicate of [Best practices or experience with company wide Username policies and resolving duplicates](http://serverfault.com/questions/42204/best-practices-or-experience-with-company-wide-username-policies-and-resolving-d) – Shane Madden Jan 11 '12 at 20:52
  • 2
    I'm reminded of a Dilbert strip: http://search.dilbert.com/comic/Utthead – KeithS Jan 11 '12 at 21:13
  • And then this happens, and you're left scratching your head anyway: http://tex.stackexchange.com/questions/40747/bibtex-handling-of-the-dutch-van-name-prefix-with-natbib . Names are somewhat tricky business ;) – Piskvor left the building Jan 11 '12 at 23:48
  • my university was initial + surname + number. I became anel1. Not a good name if you have to give other people your email. I expect I will be anal for the rest of my life. – nelaaro Jan 12 '12 at 09:57
  • I'd like to add a worst practice: Do **not** think that consecutive integers are the way to go. Or that you should add randomness into accounts because your system can't check password strength. My university (Würzburg) does both, with student accounts looking like `s123456` and staff like `stw78ye`. Creates a horrible mess everywhere. – thiton Jan 12 '12 at 10:32
  • as @thiton mentioned above, numbers aren't really the best way to go. My college student login was 380063 (but my email was still firstname.lastname@college.ac.uk). – tombull89 Jan 12 '12 at 12:31
  • Our company (Windows-centric) uses "firstname.lastname" and Adobe installs and updates always fail because they're unable (for whatever reason) to create a certain file based on our usernames. They have to be installed by an account without a period, i.e., "admin". – Lobstrosity Jan 12 '12 at 15:38
  • you're still running Windows 2000? Eek! It's way past EoL :-| – warren Jan 12 '12 at 20:46
  • We go with initials, two digit year, then three digit incrementing sequence number. John Q Smith is jqs12001, the next person to show up in 2012 with the initials jqs gets jqs12002. If the middle initial isn't on file, use the second letter of first name. Once it is set, we don't change it if a name changes. Users are allowed three email aliases with a default of firstname.lastname@domain.com, new ones are reviewed by a human after you fill out the webform. – JamesCW Jan 13 '12 at 03:01
  • Subjective question (and I can't believe it is still open), but as you've asked... I always use preferred_name.surname, as many people (myself included) have a first name that they don't actually use, which would just confuse co-workers and customers that weren't aware of this. – Bryan Jan 13 '12 at 08:25
  • At a place I used to work at, our systems had accounts for users from all corners of the earth. The convention was . If uniqueness was an issue we'd add more characters from the first name, followed by a number if needed. I remember one user, with the name of 'Ty Shi'. We struggled for a long time to come up with a suitable username. – Bryan Jan 13 '12 at 08:30

7 Answers7

67

This is a chronic problem with large Identity Management systems attempting to glue together heterogeneous systems. Invariably, you'll be limited to the lowest common denominator, which all too often is an 8-character ASCII-alpha-numeric limit thanks to some (probably legacy) Unix-like system somewhere in the bowels of the datacenter. Those fancy modern systems can take arbitrary length UTF8 usernames are unlikely to get used.

I spent 7 years at an institution of higher education where we had to figure out 8-character usernames for 5000 new students every year. We had managed to come up with unique names for 15 years of students by the time I left. This can be done, Mr. smitj510

Things that will make your life immeasurably easier:

  • Figure out what your lowest-common-denominator is, which requires analyzing every part of your identity-management system to discover what the limits are.
    • That old Solaris 7 system is forcing the 8-character limit.
    • Critical applications that use identity data have their own limits you will have to consider.
      • Perhaps they expect user data from LDAP to conform to a unique-to-them 'standard'.
      • Perhaps the authentication database they use can only handle certain formatted data.
      • Perhaps that Windows-compatible system still uses SAMAccountName two decades after that stopped being a good idea.
  • Have a database table with a list of the One True Identifier (that 8-character account-name), with links/fields listing alternate ID's like firstname.lastname or anything else that might come up.
    • Off-the-shelf software can do some really weird and IDM-unfriendly things like use a numerical ID for account name, or auto-generate account IDs based on profile data. All that goes into the database table too.
    • This also helps people with non-[a-z|0-9] characters in their names like Harry O'Neil, or non-ASCII ones like Alžbêta.
  • When you build your account synchronization processes, leverage that database table to ensure that the right accounts are getting the right updates. When names change (marriage, divorce, others) you want those changes to propagate to the right places.
    • Configure the actual identity databases themselves to prevent local-changes where possible, and business process to strongly discourage that when it isn't possible. Rely on the central account-sync process for everything you can.
  • Leverage alias systems wherever you can, such as in email.
  • Consider the 8-char ID immutable, since changing that field can trigger a LOT of heart-ache among IT staff as accounts have to be recreated.
    • This suggests an account-ID not derived from name data, since marriage/divorce/court-order can change the name-data over time.
  • Have a system in place for exceptions, since there will always be some.
    • Horrible divorce and that name-data generated 8-char UID brings wrenching memories every time you have to enter it? Be nice to your users and allow a mechanism for these changes, but keep it quiet.
  • Do what you can to allow multiple username logins in the systems where that's an option
    • Some people like their 8-character uid, others like firstname.lastname@example.com. Be flexible, make friends.
    • Sometimes this requires fronting your web-based systems with a framework like CAS or leverage . You will be surprised at how many off the shelf systems can support SSO frameworks like this, so don't be discouraged.

Which is to say, treat it like a databasing problem because that's what it is. Pick a primary key for maximum compatibility with your systems (likely 8 characters), build a lookup-table to allow systems to translate local ID's to the primary key, and engineer your data synchronization systems to handle various IDs.

sysadmin1138
  • 131,083
  • 18
  • 173
  • 296
  • 4
    Fantastic and well-written (and illuminating) answer! – Mei Jan 11 '12 at 19:46
  • 14
    +1 For not deriving usernames from name data. Having to rename home directories because of marriage / divorce is irritating. Your statement about "odd characters" makes me think of Little Bobby Tables and the janitor at my old High School, who I am sure has problems purchasing things online, Mr. Robert Null (I kid you not). – Evan Anderson Jan 11 '12 at 20:32
  • I like the "Have a system in place for exceptions, since there will always be some." part. This definitely is very true. Although I don't see how `smithj510` makes a great *eight* character username ;) – scherand Jan 11 '12 at 22:04
  • 2
    +1 for addressing marriage and divorce. This has caused so many problems. Many companies act like the employee is the first to have to change their name. – mhoran_psprep Jan 12 '12 at 02:43
  • 5
    @mhoran_psprep And if you're big enough, you're going to get someone doing a legal *first* name change. Many systems set up for last-name changes break in that case. – sysadmin1138 Jan 12 '12 at 03:03
26

Your questions specifically:

  • What is the best username length limit to use to maintain compatibility across all uses?

There's no such thing. There's only "your" uses, which may include your future uses. We have no idea what those are.

  • What characters should be avoided?

This will depend on what computer systems you're dealing with. Windows, for example, has no problems with a period in the username. In fact, the UPN is formatted like an email address, which allows a period.

My further thoughts:

  • Don't let your users ask - tell them what the standard is, and be open to the business (not individual users) requesting changes to the standard as requirements change.
  • Do make an "exception policy" in the standard, so you can help out poor Susan Penington and Mary Utt (from comments above) without having to involve a vice-president. Make IT look good, right?
mfinni
  • 35,711
  • 3
  • 50
  • 86
  • 15
    That last comment is worth a +50 :) – Mei Jan 11 '12 at 17:11
  • 2
    Coming up with sensible exceptions is critical. We've had many exceptions over the years: multiple users with the same initial and last name, users with very long last names, users whose first and last names were the same, users visiting from China and HR got their name totally scrambled, someone whose name was spelled 'Raymond Luxury-Yacht', but pronounced 'Throatwobbler Mangrove'... – Ward - Reinstate Monica Jan 11 '12 at 18:21
  • BobHope, BobHope01, BobHope3, BobHopeAccounting, BobHopeHartford – mfinni Jan 11 '12 at 18:57
  • +1 for "Tell your users what the standard is" and having a policy for sensible exceptions. For the record our policy is bifurcated (emails are always `firstname.lastname@`, Unix accounts are always first initial + last name (in both cases collisions are resolved on an as-needed basis) – voretaq7 Jan 11 '12 at 22:40
  • 2
    Yes for the exception! Some countries in Africa don't even know the concept of a "first name" and "last name": the father's first name becomes the son's last name, and the son gets a new first name... – Konerak Jan 12 '12 at 07:38
  • Unless it's a huge organization, why not let users at least request whatever valid user name they like, as long as it's not already taken? A concrete example: if I'd rather be `kst` than `kthompso`, what's the harm in allowing it? – Keith Thompson Jan 12 '12 at 09:59
  • Keith - standards is the reason, and the original question is asking for best practices. Standardization is a best practice, quite simply. Now, "best practice" just means "This is what has been tested to work well in most cases", so any org can deviate from it as they see fit. – mfinni Jan 12 '12 at 13:44
  • @KeithThompson the reason for having a standard is that it makes things easier to remember. If (almost) everyone's username follows the same convention its much easier to generate them from memory. This is a time saver even when you have ready access to a corporate address book; and even more valuable when you don't; eg sending an "I'm sick" email to your boss and coworkers from your personal account instead having to VPN into the company system. – Dan Is Fiddling By Firelight Jan 12 '12 at 15:21
  • 2
    I'd recommend going beyond just having an exception policy, and IDing users who'd likely benefit from it at the initial account creation time. "My username is horrible" shouldn't be something a new hire should need to worry out on their first day. An explanation of the standard policy combined with acknowledging that it might not be suitable for an individual along with a suggested alternative is much less stressful. Possibly even getting contact info from HR so you can resolve the issue before their first day. – Dan Is Fiddling By Firelight Jan 12 '12 at 15:42
  • @DanNeely: I suppose it depends on your setup. At my last job, my username was 8 letters, but my e-mail address was of the form `First.M.Last@cexample.com` (and `username@example.com` wasn't a valid e-mail address). There was rarely a need to know somebody else's username. And if I *assume* that John Smith's username is `jsmith`, I could accidentally send an e-mail to Jeff Smith, or Joan S. Mith. If I need someone's username and/or e-mail address, I can look it up, either in my contacts list or on the company server; *assuming* what someone's username is is IMHO poor practice. – Keith Thompson Jan 12 '12 at 22:27
  • @DanNeely: For a sufficiently large organization, the overhead of allowing users to request specific usernames might be too much of a burden for the admins. For a medium or smaller organization, though, since I'm going to have to type my username several times a day for years, I just think letting me have the one I want is a nice touch. For example, if there's a form I have to fill out before my account is set up, perhaps it can let me specify 2-3 preferred usernames. If they're all taken or inappropriate, they can always fall back to the standard. Not a huge deal, but nice to have. – Keith Thompson Jan 12 '12 at 22:29
  • @DanNeely: More briefly: There are always going to be exceptions to whatever standard you choose (because there's already a jsmith, for example). Why shouldn't "the user just prefers this username" be considered another valid reason for an exception? – Keith Thompson Jan 13 '12 at 10:25
  • If you can't type it on the sysadmin's keyboard, the characters shouldn't be allowed. :P I have a few answers on SO about character encoding based on experience with windows. – Krista K Dec 30 '13 at 12:39
20

My experience has been that, for a sufficiently large enterprise, any decision you make will always have problems. Even if it works today, there's always the system you implement tomorrow that has problems with the prior standard (length issues, character problems, etc).

Be sure to find out if the push for Firstname.Lastname relates to email and not necessarily login names. I'd find it hard to believe that the user wants to type "John.Smith" instead of "jsmith" when logging-on, but I'm much more sold on the idea that he wants "John.Smith@company.com" as his email address. As @Mfinni points out, there's always the option for users to have mutliple email aliases, forwards, etc. Just letting users know that the option exists to de-couple their username from their email address can change the dynamic of the request.

nedm
  • 5,610
  • 5
  • 30
  • 52
Evan Anderson
  • 141,071
  • 19
  • 191
  • 328
  • 1
    And it's not like users can only have one email address. There's always aliases and forwarding. – mfinni Jan 11 '12 at 16:46
  • 3
    Our users UPN's and primary e-mail addresses are identical at all times, so we just simply tell our users to log on with their email address wherever they try to log in. Works great since we don't have any old software that relies on netbios. – pauska Jan 11 '12 at 19:01
  • My experience has been that, for a sufficiently large enterprise, any decision you make will always have problems. Even if it works today, there's always the system you implement tomorrow that has problems." - Can we call this Andersons Law ? – Freiheit Jan 11 '12 at 20:25
  • @Freiheit: My statement isn't deserving of its own name... >smile< It's really just caused by the general application of Murphy's Law to IT. Murphy _lives_ in IT... – Evan Anderson Jan 11 '12 at 20:31
  • 1
    Wish I hadn't Community Wiki'd this one now... >smile – Evan Anderson Jan 11 '12 at 20:33
  • @EvanAnderson I fix. – sysadmin1138 Jan 11 '12 at 21:30
13

For Unix and Linux systems, {firstInitial}{lastname} is clearly ideal.

...

for reasons that should be obvious from the name associated with this account.

Robert Oot
  • 155
  • 4
  • 3
    I'm not disagreeing, but can you explain why you're saying this? – mfinni Jan 12 '12 at 13:45
  • In fact, I will disagree. On the AIX systems at my last job, we were limited to 8 characters. Thus, mfinnigan would have been impossible; I had to be mfinniga. So please, expand your answer a bit. – mfinni Jan 12 '12 at 14:50
  • 2
    This is a subjective answer with no explanation. One could just as easily say that, for UNIX, _{firstInitial}{middleInitial}{lastInitial}_ is "ideal" since that's what UNIX started with and that's the way it was for years (until corporations with thousands of employees with usernames started using it...). – Mei Jan 12 '12 at 15:57
  • Or just *firstname* – mfinni Jan 12 '12 at 16:38
  • Not really. It depends on your organization's size. If you've got ten people in your org, then the likelihood of a collision is small. When you've got hundreds or thousands, the likelihood that you'll have multiple John Smith's goes up, causing a collision. You could certainly mix it up by using the middle initial (but what do you do if the person has none?) or some numerical index (this is the 10th John Smith at the company), but that may not necessarily work. Also, what do you do if your organization has a policy of "You may never re-use usernames." It happens. – Travis Campbell Jan 12 '12 at 19:55
  • 10
    uh, I think it might be a joke. His name would be "root," a significant user on Unix systems. – Jeffrey Jan 13 '12 at 06:09
  • @Jeffrey: Exactly! – Robert Oot Jan 13 '12 at 10:28
  • Joke Comprehension Fail for finnigan : -1 nerd point – mfinni Jan 13 '12 at 14:38
  • 4
    ... **R** obert **Oot**... _ouch!_ FUNNY! Don't know how I missed it. – Mei Jan 13 '12 at 17:18
  • Funny, yes. Practical? Disproven by counterexample :) – voretaq7 Jan 17 '12 at 19:29
7

One thing to be aware of when setting naming standards across platforms is a particular cosmetic issue in ps in Linux (and possibly other Unix OSes). You may or may not care about this (but it can be alarming to someone who isn't expecting it ... I've had security folks twitch on this one).

The UID column will only display up to 8 characters of a username. If the username is longer than 8 characters, it will switch over to printing the actual numeric UID. You CAN get around this by having a custom ps column format that contains the USER field, but ONLY if USER is the last column (from my empirical testing).

Most people probably do not care about this, but if you're doing some sort of processing of ps output and expecting the real usernames to appear, you should be careful with your name lengths (otherwise, you'll be putting hacks in your code to make ps do the Right Thing).

For example:

Here's the default column format for the full format listing. Note that my uid is in numerical format because my username is > 8 characters.

[tcampbell@tst-agg1 ~]$ ps -f
  UID        PID  PPID  C STIME TTY          TIME CMD
 2108      1368  1367  0 Jan10 pts/3    00:00:00 -bash
 2108     22303  1368  0 12:07 pts/3    00:00:00 ps -f

Let's recreate it using a custom column format. Note that I've added the USER column. Note that it's also in numerical format.

[tcampbell@tst-agg1 ~]$ ps -o uid,user,c,stime,tty,time,cmd    
  UID USER      C STIME TT           TIME CMD
 2108 2108      0 Jan10 pts/3    00:00:00 -bash
 2108 2108      0 12:05 pts/3    00:00:00 ps -o uid,user,c,stime,tty,time,cmd

Let's move USER to the end of the line. It gets expanded to the "right" output.

[tcampbell@tst-agg1 ~]$ ps -o uid,user,c,stime,tty,time,cmd,user
  UID USER      C STIME TT           TIME CMD                         USER
 2108 2108      0 Jan10 pts/3    00:00:00 -bash                       tcampbell
 2108 2108      0 12:05 pts/3    00:00:00 ps -o uid,user,c,stime,tty, tcampbell

But, as soon as we add something new to the end of the column list, it reverts back to numerical form.

[tcampbell@tst-agg1 ~]$ ps -o uid,user,c,stime,tty,time,cmd,user,pid
  UID USER      C STIME TT           TIME CMD                         USER       PID
 2108 2108      0 Jan10 pts/3    00:00:00 -bash                       2108      1368
 2108 2108      0 12:05 pts/3    00:00:00 ps -o uid,user,c,stime,tty, 2108     21756
Travis Campbell
  • 1,456
  • 7
  • 15
  • Which OS have you found this applies to? – mfinni Jan 11 '12 at 18:58
  • Interesting! I always wondered about that - why numbers were being used. The `last` command has a related problem: it truncates its records to 8 characters. – Mei Jan 11 '12 at 19:05
  • Edited to reflect that I was talking about Linux. Don't know how that slipped past in my original edits. – Travis Campbell Jan 12 '12 at 16:58
-1

Well, from an Operations, Administration, and Maintenance (OAM) point of view, the username needs to be easily distinguished. However, from a business point of view, the username (a/k/a email alias) has to be easily be remembered or recalled by others.

It can be like:

  • first.last.index@domain
  • first(initial).last.index@domain
Mei
  • 4,560
  • 8
  • 44
  • 53
Eddie
  • 3
  • 3
-1

[some letters from firstname][some letters from lastname][nnn]

foreg: If name is Bill Gates, you can use ' biga00 ' or bilgat000

if next bill gates comes , it shall be 'biga01' or bilgat001' for him

SKumar
  • 1