How Secure must Continuum be?

[Andreas Guther <An...@markettools.com>]

Hi,

 

It is certainly important that users identify themselves prior to using
Continuum.  I also understand authenticated users are pre-condition for
role management.   And I am all for securing systems.  

 

In our case we run Continuum internally in a controlled environment.
The security policies in Continuum are for our taste overkill:  

 

n  Users are expected to change their password after some time

n  Users cannot use the last 6 passwords

 

This is much more than one finds for example using Jira.  

 

Is there a way to loosen the security policy, for example to not expire
passwords?  Setting a flag that the password never expires, for example?


 

Andreas

 

 

RE: How Secure must Continuum be?

[Andreas Guther <An...@markettools.com>]

Thank you very much.  That was the missing information!

Andreas


-----Original Message-----
From: Wendy Smoak [mailto:wsmoak@gmail.com] 
Sent: Wednesday, May 07, 2008 10:21 AM
To: users@continuum.apache.org
Subject: Re: How Secure must Continuum be?

On Wed, May 7, 2008 at 9:13 AM, Andreas Guther
<An...@markettools.com> wrote:

>  Is there a way to loosen the security policy, for example to not
expire
>  passwords?  Setting a flag that the password never expires, for
example?

Happily, this is all configurable. :)  I'm going to link to the draft
docs for the next version, because this page wasn't written when 1.1
was released:

http://continuum.apache.org/docs/1.2-SNAPSHOT/administrator_guides/secur
ity/customising-security.html

-- 
Wendy

Re: How Secure must Continuum be?

[Wendy Smoak <ws...@gmail.com>]

On Wed, May 7, 2008 at 9:13 AM, Andreas Guther
<An...@markettools.com> wrote:

>  Is there a way to loosen the security policy, for example to not expire
>  passwords?  Setting a flag that the password never expires, for example?

Happily, this is all configurable. :)  I'm going to link to the draft
docs for the next version, because this page wasn't written when 1.1
was released:

http://continuum.apache.org/docs/1.2-SNAPSHOT/administrator_guides/security/customising-security.html

-- 
Wendy