We have Federated Authentication implemented for our SSO and therefore a separate set of password policies are being applied from the client app. I found this SF article but it is only referring to Delegated Authentication, which confirms that Salesforce does not enforce anything around the password.
Just wanting to be 100% sure that the same is applied for Federated Auth. I believe so because in comparing policies between SF and the client app, SF has the stricter policy and yet log ins are permitted. If there is any documentation out there, or from your experience you can confirm, it would be appreciated.