Password Expiration UI Logic Bug

[neilt]

To recreate:

1. Create a new company company1
2. Setup company1 with user Jack, password abcdef
3. Set company1 Settings -> Defaults -> password duration to 400 days
4. Change Preferences -> Password to something else. This is required to get the new 400 days active.
5. Logout of Company1
6. Create a new company2 using setup.pl
7. Select Jack as a user for company2 using the existing user Jack
8. Logout of company2
9. Wait for more than 1 day
10. Try to login to company1 and fail because the the password expired

The symptom:

1. To resolve set a new password for user jack using setup.pl
2. Login the company1
3. Go to Preferences -> Preferences and see the message that your password expires in 1 day
4. Go to Settings -> Defaults -> password duration and see that it is set for 400 days.
5. Wonder why if it is set for 400 days it just expired. Exposed UI logic bug.

The problem:

1. The UI for Settings -> Defaults -> password duration is wrong when the users is setup from another company. I understand it is because there is only 1 user for both companies.

Solutions:

1. Maybe there is a way to use the same user in setup.pl for a new company without resetting the password that needs to be documented.
2. When the 2nd company is created and the users is set back to 1 day password expiration maybe the 1st company needs to have the defaults reset.
3. Maybe when using an existing user for the 2nd company we should not reset the password details at all.

I think 3 is the correct answer, but maybe there are details I don't understand.

[neilt]

After thinking more on this I think the password duration is possibly in the wrong location in the UI. It is an attribute of the User not the company and therefore belongs with the password change UI. Preferences -> Password or System -> Users.

[ehuelsmann]

There is a mismatch in expectations here: the password expiration setting is applied when the password is set, not when it is checked.

[ehuelsmann]

The password isn't changed when you import a user (use the existing role/login name in another company) when you leave the password field empty.

[neilt]

There is a mismatch in expectations here: the password expiration setting is applied when the password is set, not when it is checked.

That was my expectation, but that is not my point.

Consider the following.

1. Create the first company with an initial user and password expiration of 10 days, and reset the password
2. Create the second company by importing the initial user
3. Go to company 2 Default Settings and change the password expiration to 20 days, do not reset the password
4. Now go back to company 1 and observe the Default Settings, password expiration. It is 10 days, right.
5. You are saying that it takes the company default and applies it when the password is changed from that company.
6. That does not make sense to me. A users can only have one expiration because it is set on the user when the password is set. But there are two defaults, different for each company. This may work, but the interaction is logically wrong. Why can there be two completely different default expiration intervals depending on which company was used to change the password?
7. So now go back to company 2 and login 11 days later. Whoa, password expired. Why? I set the password expiration for 20 days for company 2. That is wrong, the password expiration interval for company 2 is 10 days unless the password is reset from company 2.