search

larrabee / freeipa-password-reset

Self-service password reset app for FreeIPA
GNU General Public License v3.0
88 stars 30 forks source link

Follow Password Policy #29

Open fsadoon opened 4 years ago

fsadoon commented 4 years ago

First, thanks for your magnificent work !! one small thing while testing, users are setting there passwords without following password policy i know this is something related to ldap-passwd-reset user account, any idea how to fix this ?

Regards

fsadoon commented 4 years ago

Any Idea ? :(

larrabee commented 4 years ago

Hello.
I will check it latter, now a lot of work.

fafa1681 commented 4 years ago

Sorry, I have the same problem, did you have a solution??

fafa1681 commented 4 years ago

Any Idea ? :(

Hi, Have you found a solution?

fsadoon commented 4 years ago

Sorry bro, didn't see your comment ,

I did find a solution with another project called " PWM " try it out

fafa1681 commented 4 years ago

great, thanks bro!!

fsadoon commented 4 years ago

Any time .. you will faca an issue with the SSL certificate if u use the docker image , they promised they will fix it, IDK if they did

jpurtell1 commented 3 years ago

I'm coming across this same issue. I'd like to implement this into the Production environment, but know it wont pass security without complying to our password policy. Currently, you can reset your LDAP password to whatever you want. Length, complexity don't apply.

I see this has sat for about a year. Any chance there will be a fix to this issue? Seems like it's a small fix to what looks like a wonderful solution to a self-service problem.

Thanks

jpurtell1 commented 3 years ago

I addressed the password policy issues with a "work around". I put the policy rules in the javascript that was already checking to make sure the new password matched. I just expanded it to include a minimum length check and a regex to ensure upper, lower, alpha-numeric and special characters are being used in the new password. If any of these checks fail, a message is displayed explaining the requirements and if the passwords didn't match. As originally written.

I've pasted the java script below, and attached the 'setpassword.html' file for anyone to grab and implement into their environment for testing.

Cheers! JP

setpassword.html.txt

/opt/data/IPAPasswordReset/PasswordReset/app/templates/setpassword.html

exeq89 commented 6 months ago

I addressed the password policy issues with a "work around". I put the policy rules in the javascript that was already checking to make sure the new password matched. I just expanded it to include a minimum length check and a regex to ensure upper, lower, alpha-numeric and special characters are being used in the new password. If any of these checks fail, a message is displayed explaining the requirements and if the passwords didn't match. As originally written.

I've pasted the java script below, and attached the 'setpassword.html' file for anyone to grab and implement into their environment for testing.

Cheers! JP

setpassword.html.txt

/opt/data/IPAPasswordReset/PasswordReset/app/templates/setpassword.html

i used this, works like a charm