freeipa

#2445 [RFE] IdM password policy should include checks for repeating characters
Closed: fixed by rcritten. Opened by dpal.

Closed: fixed
Reopen Issue

Policy should allow definition and enforcement of the following password policies:

  • At most N consecutive occurrences of the same character.
  • At most N consecutive increasing or decreasing alphanumeric characters

Inspired by BZ https://bugzilla.redhat.com/show_bug.cgi?id=681694

Ticket has been cloned to Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=798359

Metadata Update from @dpal:
- Issue assigned to rcritten
- Issue set to the milestone: Ticket Backlog

master:

  • 41021c278ae572ff5b1b3dea828a7dd93fe1ffff Add LDAP schema for new libpwquality attributes
  • 6b452e54045bb957e6f787209b4498eefc5df779 Extend IPA pwquality plugin to include libpwquality support
  • c03b4862b84d52ddc91c5a3fb885b0ebf753d8f2 Add new pwpolicy objectclass to test_xmprpc/objectclasses.py
  • 3fc2eda4e15e9592132062036d70acad3bab401c Require libpwolicy and configure it in the build system
  • c4cca53e88e78bfe512ebe59898ede0f94ec24ff Extend password policy to evaluate passwords using libpwpolicy
  • 46d0096218488a961125b6d97a9210b68e5434e5 Add a unit test for libpwquality-based password policy
  • 6da070e655c5d084a825607ed3be604c809b12f0 Pass the user to the password policy check in the kdb driver
  • be2efc12d37018794200fee874f27d83e0442ea4 Add a raiseonerr option to ldappasswd_user_change
  • fe44835970eca197543eb3c908c51a240204d846 ipatests: add test for password policies
  • 68aa7c05542422aca05bec4967133be09a32496e Add SELinux policy so kadmind can read the crackdb dictionary
  • f602da4b28fcf8822225b80df241eed6b624bf8e Requirements and design for libpwquality integration
  • 5155280bb4a92eb3dfdee5ca3f3a332f0159d568 ipatests: Add test_pwpolicy to nightly runs

ipa-4-8:

  • 04c34dcb33fa2e1ed6103250257c00e03ad93a22 Add LDAP schema for new libpwquality attributes
  • e8232dd0846963b1af7dc96ddbc99c75ef8333d5 Extend IPA pwquality plugin to include libpwquality support
  • 4dcb8d98e100d1fad89600b312b301e87d79f704 Add new pwpolicy objectclass to test_xmprpc/objectclasses.py
  • 734afe3896896a5633a926a4af08a58bceb966fd Require libpwolicy and configure it in the build system
  • 43cdcad24082bdb8356c44de78bfa69162e0ca6a Extend password policy to evaluate passwords using libpwpolicy
  • cba86e814d44169b0275f908a389b67ddc462ce7 Add a unit test for libpwquality-based password policy
  • d6a8fc290aa93fc5d53025f4400a9736366175eb Pass the user to the password policy check in the kdb driver
  • 676979eb510f71639ae0ccb16a44b75e3c084245 Add a raiseonerr option to ldappasswd_user_change
  • 9627ac4496cd3631250ed21e20157d41d27d6052 ipatests: add test for password policies
  • 60768b7344fcd0ad991ed1dc78c7a8f9784dc031 Add SELinux policy so kadmind can read the crackdb dictionary
  • 48801cba3ffb76ba01fa908b13a8ff400423793f ipatests: Add test_pwpolicy to nightly runs

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

master:

  • 26b9a697844c3bb66bdf83dad3a9738b3cb65361 Wrap libpwquality PKG_CHECK_MODULES in ENABLE_SERVER test

ipa-4-8:

  • 3e51d443a659513767dffc2b00920004a81e2ef1 Wrap libpwquality PKG_CHECK_MODULES in ENABLE_SERVER test

Metadata Update from @abbra:
- Custom field changelog adjusted to FreeIPA password quality checking plugin has been extended to use libpwquality library. Password policies can now check for a reuse of a user name, dictionary words using a cracklib package, numbers and symbols replacement and repeating characters in the passwords.
Metadata
None
None
None
Normal
enhancement
IPA
0
FreeIPA password quality checking plugin has been extended to use libpwquality library. Password policies can now check for a reuse of a user name, dictionary words using a cracklib package, numbers and symbols replacement and repeating characters in the passwords.
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.