Details
-
Story
-
Status: Closed (View Workflow)
-
P3
-
Resolution: Done
-
None
-
None
-
-
EPAM Sprint 1, EPAM Sprint 2
-
5
-
Folijet
-
Large < 10 days
-
Depends on where configuration lies. Tenant level may represent default configuration and in a future release, will support the ability for tenants to make updates via UI.
-
Medium < 5 days
Description
As a Folio System Administrator
I want to enforce strong local password rules
So that the ability for someone to illegally access or brute force attack Folio is minimized.
Requirement
- Implementation needs to be flexible to make global password requirement updates (e.g. minimum requirement)
- Implementation need to be flexible to support tenant level password requirement updates based on an institution's requirements.
- For users that had access when no password rules were implemented, ensure that have access as long as status = active.
- if the status changed from inactive to active then force the user to comply with current password requirements.
- Otherwise all new users must comply with new rules
Valid password requirement rules
- Has a minimum 8 characters (frontend)
- Contains both lowercase and uppercase letters (frontend)
- Contains at least one numeric character (frontend)
- Contains at least one special character (frontend)
- Is not your username (backend)
- Is not on the bad passwords list(s) (
UIU-509) (frontend) - Cannot be a word in a TBD dictionary (
UIU-509) (frontend) - Is not a keyboard sequence (ex. 123456) (frontend)
- Is not the same character (ex. BBBBBBB) (frontend)
- Is not one of the last 10 previously used password (
UIU-510) (backend)
TestRail: Results
Attachments
Issue Links
- is blocked by
-
MODLOGIN-31
Extend mod-login with the ability to update user's own password
-
- Closed
-
- relates to
-
MODLOGIN-33
Prevent Local Password Re-Use (at least the last 10 passwords)
-
- Closed
-
-
MODLOGIN-35
Select a bad password list(s)
-
- Closed
-
-
MODPWD-32
Do not use password complexity requirements
-
- Closed
-
-
MODPWD-35
Drop keyboard sequence and repeating symbols password substring requirements. And update white space character password rule
-
- Closed
-
-
MODPWD-51
Implement a bad password list(s)
-
- Closed
-
-
STSMACOM-338
Handle error message for a new password validation rule
-
- Closed
-
-
UIMPROF-13
Change Password: Prevent Local Password Re-Use (at least the last 10 passwords)
-
- Closed
-
-
UIMPROF-20
Implement a Password Strength Meter
-
- Closed
-
-
UIU-516
Spike: Select a Password Strength Meter
-
- Closed
-
-
UXPROD-39 Local password management
-
- Closed
-
-
MODLOGIN-47
Create Validator Registry component
-
- Closed
-
-
MODLOGIN-50
Create Validation Manager Component
-
- Closed
-
-
MODLOGIN-57
Create password validation rules (RegEx)
-
- Closed
-
-
MODPWD-4
Create Validator engine (Backend validator) Component
-
- Closed
-
-
MODPWD-5
Create mod-password-validator module
-
- Closed
-
-
MODPWD-6
Initial ruleset for a tenant
-
- Closed
-
-
MODUSERBL-43
mod-users-bl: add endpoint to change user password
-
- Closed
-
-
STCOR-273
Local Password Management: Create/Reset a Password Screen
-
- Closed
-
-
UIMPROF-12
Add password validator functionality to Change password page
-
- Closed
-