Password strength not used by UI

NethServer / dev

NethServer issue tracker

https://github.com/NethServer/dev/issues

63 stars 20 forks source link

Password strength not used by UI #6845

Closed stephdl closed 4 months ago

stephdl commented 4 months ago

Steps to reproduce

install an account provider
in the configuration of the ldap account provider you have a card to enable/disable strength/password complexity and set the length of the password
disable the Strength policy and set the length superior to 14
create a user with a not complex password

Expected behavior

I expect to create the user with a not complex password with only lower characters like : azertyuiop

Actual behavior

The UI still requires a complex password with minor letter , upper letter , number and symbol even if I have disable the complexity

the password length is not respected by the UI, when I set a minimal length to 14, the UI validate the length of 8

Components

core:2.4.0

Tbaile commented 4 months ago

I'll have something to add on this, ping me Monday 🙏

https://mattermost.nethesis.it/nethesis/pl/jas383xgs3rgtq8fsgxbggdk9r

stephdl commented 4 months ago

discussion with andrea https://mattermost.nethesis.it/nethesis/pl/s7ecn7juutdd7gpn9inteiuwah

stephdl commented 4 months ago

Install NS8 from ghcr.io/nethserver/core:2.5.2-dev.2 Install one account provider LDAP (ghcr.io/nethserver/openldap:user-manager-password-policy) or SAMBA AD (ghcr.io/nethserver/samba:user-manager-password-policy) Module override reference here. Create the default user administrator

once done we will need to play with the password policy of the domain

change the length of the password (default is 8, set higher or lower)
set the complexity check (require complex password or not)
disable completely the strength of the password (no length required and no complexity check)

all this check must done at

the password change of the user
when you create a new user

the password must require to the password policy expected, this applies for both the Core UI and User Manager Portal

nrauso commented 4 months ago

through cluser-admin UI everything works as expected: password policies are kept updated and are honored.

DavidePrincipi commented 4 months ago

Core released https://github.com/NethServer/ns8-core/releases/tag/2.5.2

Let's wait for Samba and OpenLDAP before closing the issue.

nrauso commented 4 months ago

Tested: VERIFIED Any change to the password policy is applied and honored by both the cluster-admin UI and User Manager Portal

DavidePrincipi commented 4 months ago

Released in