Password quirks for Technical Univeristy of Munich (TUM)

[jpbernius]

Overall Checklist

• [X] I agree to the project's Developer Certificate of Origin
• [X] The top-level JSON objects are sorted alphabetically
• [X] There are no open pull requests for the same update

~for password-rules.json~

• [ ] ~The given rule isn't particularly standard and obvious for password managers~
• [ ] ~Generated passwords have been tested from this rule using the Password Rules Validation Tool~
• [ ] ~Information has been included about the website's requirements (eg. screenshots, error messages, steps during experimentation, etc.)~
• [ ] ~The PR isn't documenting something that would be a common practice among password managers (e.g. minimal length of 6)~

for change-password-URLs.json

• [X] There is no Well-Known URL for Changing Passwords (https://example.com/.well-known/change-password)
• [X] The URL either makes the experience better or no worse than being directed to just the domain in a non-logged-in state

for shared-credentials.json

• [X] There's evidence the domains are currently related (SSL certificates, DNS entries, valid links between sites, legal documents etc.)
• [X] If using shared, the new group serves login pages on each of the included domains, and those login pages accept accounts from the others. (For example, we wouldn't use a shared association from google.co.il to google.com, because google.co.il redirects to accounts.google.com for sign in.)
• [ ] ~If using from and to, the new group, the from domain(s) redirect to the to domain to log in.~

~for shared-credentials-historical.json~

• [ ] ~You believe that the domains were associated at some point in the past and can explain that relationship~

---

Here are some login pages:

• https://portal.mytum.de/login_form
• https://login.tum.de servers a Shibboleth (SAML) Login Service
• http://gitlab.lrz.de and https://idmportal.lrz.de
• https://xmail.mwn.de hosts webmail (see documentation about relationship to TUM)

And here is some evidence regarding the relationship between tum.de, mytum.de, lrz.de, and mwn.de:

• LRZ (lrz.de) is the "Leibniz Supercomputing Centre"
• LRZ operates the Munich Scientific Network (MWN) (mwn.de)
• LRZ provides services, including identity management for TUM.
• tum.de and mytum.de both list "Technische Universitaet Muenchen" in the SSL Cert

Users may only update their central TUM account (managed by LRZ) password on campus.tum.de.

I hope I did not miss a link. If anything is unclear, please ask.

[igor-makarov]

So nice to see all the lints passing! 👍🏻

[jpbernius]

You're very welcome 😉