Additional password checks #1067
Conversation
… function name was changed to detect_language
…r surname are inside the new password. - It can be enabled/disabled in config ($pwd_diff_namesurname) - It requires restapi to be enabled ($use_restapi) - It uses the api endpoint /rest/v1/checknamesurname.php - Both english and french languages are currently supported
…rted) for future backend verification (Ltb-common)
…e linked to a given login, to be used by the ltb-common library
|
For frontend feedback : ltb-project/ltb-common#71 |
|
Hello, why don't use |
|
Hello, I didn't notice this. The backend part of my fork is basically useless, but I believe the api as well as the frontend would still be useful as a lot of users tend to put their name or surname in their password, and the feedback message after submission isn't really clear. |
|
Hello, let me know what you think. |
|
This issue is in backlog for now, it is too specific for the moment (checking only name and surname). Using the current generic parameter |
|
I can change it so that it checks every forbidden ldap field dynamically when the user is typing its password, and display a feedback similar to "Your password may not contain personal informations". What do you think? |
|
You can give a try. I don't swear it will be included as it can be a security flaw: this would allow to discover informations from LDAP directory. |
|
For the security, I will change the api endpoint so that it validates passwords instead of returning LDAP data. |
- takes a login and a password as x-www-form-urlencoded format parameters - returns an "isValid" boolean - uses the project root cache folder to store recent LDAP queries using symfony cache system The "isValid" boolean returned is : - true if the login doesn't exist in the LDAP - true if the login exists and the password doesn't contain any forbidden ldap entry - false if the login exists and the password contains a forbidden ldap entry
qrainaud
force-pushed
the
additional-password-checks
branch
from
c5dfb62 to
4ccf748
Compare
update "pwd_forbidden_ldap_fields" from pwd_policy_config array in index.php for future template display
|
Hello again, let me know what you think. |
|
Sorry for the lack of activity, we are not focused on SSP development for now. I keep this issue open for review |
2 participants
New password check option : check if new password contains either name or surname
$pwd_diff_namesurnamein confightdocs/change.phpafter submit/rest/v1/getnamesurnamefromlogin.phpapi endpoint for future frontend feedback