You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@directory.apache.org by "Enrique Rodriguez (JIRA)" <ji...@apache.org> on 2007/04/09 08:37:32 UTC
[jira] Created: (DIRSERVER-899) Support centralized password policy
enforcement
Support centralized password policy enforcement
-----------------------------------------------
Key: DIRSERVER-899
URL: https://issues.apache.org/jira/browse/DIRSERVER-899
Project: Directory ApacheDS
Issue Type: Improvement
Components: changepw, core
Reporter: Enrique Rodriguez
Assigned To: Enrique Rodriguez
Priority: Minor
Fix For: 1.5.2
Currently, password policy is not applied centrally, let alone per "realm" or subtree/subtree refinement. The Change Password protocol provider enforces a best-practice password policy. However, this is bypassed during other password sets, such as during LDIF load or LDAP add and modify operations.
Password policy enforcement should move to the core, for reuse by other mechanisms for password changes.
Password policy is currently enforced in the CheckPasswordPolicy IoHandlerCommand.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (DIRSERVER-899) Support centralized password policy
enforcement
Posted by "Alex Karasulu (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DIRSERVER-899?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Alex Karasulu updated DIRSERVER-899:
------------------------------------
Fix Version/s: (was: 1.5.3)
1.5.5
see rd map
> Support centralized password policy enforcement
> -----------------------------------------------
>
> Key: DIRSERVER-899
> URL: https://issues.apache.org/jira/browse/DIRSERVER-899
> Project: Directory ApacheDS
> Issue Type: Improvement
> Components: changepw, core
> Reporter: Enrique Rodriguez
> Assignee: Enrique Rodriguez
> Priority: Minor
> Fix For: 1.5.5
>
>
> Currently, password policy is not applied centrally, let alone per "realm" or subtree/subtree refinement. The Change Password protocol provider enforces a best-practice password policy. However, this is bypassed during other password sets, such as during LDIF load or LDAP add and modify operations.
> Password policy enforcement should move to the core, for reuse by other mechanisms for password changes.
> Password policy is currently enforced in the CheckPasswordPolicy IoHandlerCommand.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (DIRSERVER-899) Support centralized password
policy enforcement
Posted by "Enrique Rodriguez (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DIRSERVER-899?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12494827 ]
Enrique Rodriguez commented on DIRSERVER-899:
---------------------------------------------
The code I had in Change Password, which I just converted to an interceptor, overlaps the LDAP password policy draft in the area of "password quality," a subset of the draft that covers character mix, password length, and "disallowing anagrams of the user's name." Put another way, I didn't implement anything that required storage, such as password history and expiration time. The LDAP draft is comprehensive and a good idea for a new feature.
I think we'll need to support pluggable policies, since enterprise requirements in this area can vary greatly. There are also competing schema, such as the draft RFC for a Kerberos schema, which has its own schema for password policy. The relevant section is 4.11 in:
http://mailman.mit.edu/pipermail/kdc-schema/attachments/20060803/caceb865/draft-rajasekaran-kerberos-ldap-schema-01-0001.txt
4.11 krbPwdPolicy
The krbPwdPolicy object is a template password policy that can be
applied to principals when they are created. These policy attributes
will be in effect, when the Kerberos passwords are different from
directory passwords.
Definition:
( IANA-ASSIGNED-OID.6.11
NAME 'krbPwdPolicy'
SUP ( top )
STRUCTURAL
MUST ( cn )
MAY ( krbMaxPwdLife $ krbMinPwdLife $ krbPwdMinDiffChars $
krbPwdMinLength $ krbPwdHistoryLength $ krbPolicyRefCount ))
> Support centralized password policy enforcement
> -----------------------------------------------
>
> Key: DIRSERVER-899
> URL: https://issues.apache.org/jira/browse/DIRSERVER-899
> Project: Directory ApacheDS
> Issue Type: Improvement
> Components: changepw, core
> Reporter: Enrique Rodriguez
> Assigned To: Enrique Rodriguez
> Priority: Minor
> Fix For: 1.5.2
>
>
> Currently, password policy is not applied centrally, let alone per "realm" or subtree/subtree refinement. The Change Password protocol provider enforces a best-practice password policy. However, this is bypassed during other password sets, such as during LDIF load or LDAP add and modify operations.
> Password policy enforcement should move to the core, for reuse by other mechanisms for password changes.
> Password policy is currently enforced in the CheckPasswordPolicy IoHandlerCommand.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (DIRSERVER-899) Support centralized password
policy enforcement
Posted by "Ersin Er (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DIRSERVER-899?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12494201 ]
Ersin Er commented on DIRSERVER-899:
------------------------------------
Enrique, Does your solution have anything to do with http://tools.ietf.org/html/draft-behera-ldap-password-policy-09 ?
> Support centralized password policy enforcement
> -----------------------------------------------
>
> Key: DIRSERVER-899
> URL: https://issues.apache.org/jira/browse/DIRSERVER-899
> Project: Directory ApacheDS
> Issue Type: Improvement
> Components: changepw, core
> Reporter: Enrique Rodriguez
> Assigned To: Enrique Rodriguez
> Priority: Minor
> Fix For: 1.5.2
>
>
> Currently, password policy is not applied centrally, let alone per "realm" or subtree/subtree refinement. The Change Password protocol provider enforces a best-practice password policy. However, this is bypassed during other password sets, such as during LDIF load or LDAP add and modify operations.
> Password policy enforcement should move to the core, for reuse by other mechanisms for password changes.
> Password policy is currently enforced in the CheckPasswordPolicy IoHandlerCommand.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Assigned: (DIRSERVER-899) Support centralized password
policy enforcement
Posted by "Emmanuel Lecharny (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DIRSERVER-899?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Emmanuel Lecharny reassigned DIRSERVER-899:
-------------------------------------------
Assignee: Emmanuel Lecharny (was: Enrique Rodriguez)
> Support centralized password policy enforcement
> -----------------------------------------------
>
> Key: DIRSERVER-899
> URL: https://issues.apache.org/jira/browse/DIRSERVER-899
> Project: Directory ApacheDS
> Issue Type: Improvement
> Components: changepw, core
> Reporter: Enrique Rodriguez
> Assignee: Emmanuel Lecharny
> Priority: Minor
> Fix For: 1.5.5
>
>
> Currently, password policy is not applied centrally, let alone per "realm" or subtree/subtree refinement. The Change Password protocol provider enforces a best-practice password policy. However, this is bypassed during other password sets, such as during LDIF load or LDAP add and modify operations.
> Password policy enforcement should move to the core, for reuse by other mechanisms for password changes.
> Password policy is currently enforced in the CheckPasswordPolicy IoHandlerCommand.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (DIRSERVER-899) Support centralized password policy
enforcement
Posted by "Emmanuel Lecharny (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DIRSERVER-899?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Emmanuel Lecharny updated DIRSERVER-899:
----------------------------------------
Fix Version/s: (was: 1.5.2)
1.5.3
Postponed.
> Support centralized password policy enforcement
> -----------------------------------------------
>
> Key: DIRSERVER-899
> URL: https://issues.apache.org/jira/browse/DIRSERVER-899
> Project: Directory ApacheDS
> Issue Type: Improvement
> Components: changepw, core
> Reporter: Enrique Rodriguez
> Assignee: Enrique Rodriguez
> Priority: Minor
> Fix For: 1.5.3
>
>
> Currently, password policy is not applied centrally, let alone per "realm" or subtree/subtree refinement. The Change Password protocol provider enforces a best-practice password policy. However, this is bypassed during other password sets, such as during LDIF load or LDAP add and modify operations.
> Password policy enforcement should move to the core, for reuse by other mechanisms for password changes.
> Password policy is currently enforced in the CheckPasswordPolicy IoHandlerCommand.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (DIRSERVER-899) Support centralized password
policy enforcement
Posted by "Enrique Rodriguez (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DIRSERVER-899?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12494179 ]
Enrique Rodriguez commented on DIRSERVER-899:
---------------------------------------------
Committed initial version of PasswordPolicyService interceptor on rev 536046 to 'kerberos-encryption-types' branch, to test in conjunction with KeyDerivationService interceptor. This initial version does not support pluggable policies in the spirit of the AuthenticationService.
URL: http://svn.apache.org/viewvc?view=rev&rev=536046
> Support centralized password policy enforcement
> -----------------------------------------------
>
> Key: DIRSERVER-899
> URL: https://issues.apache.org/jira/browse/DIRSERVER-899
> Project: Directory ApacheDS
> Issue Type: Improvement
> Components: changepw, core
> Reporter: Enrique Rodriguez
> Assigned To: Enrique Rodriguez
> Priority: Minor
> Fix For: 1.5.2
>
>
> Currently, password policy is not applied centrally, let alone per "realm" or subtree/subtree refinement. The Change Password protocol provider enforces a best-practice password policy. However, this is bypassed during other password sets, such as during LDIF load or LDAP add and modify operations.
> Password policy enforcement should move to the core, for reuse by other mechanisms for password changes.
> Password policy is currently enforced in the CheckPasswordPolicy IoHandlerCommand.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.