Drupal requires all users to have a password, including new users. In cases where administrators are creating accounts for others, this requirement seems to run counter to the following NIST recommendations: "Memorized secrets that are randomly chosen by the CSP (e.g., at enrollment) or by the verifier (e.g., when a user requests a new PIN) SHALL be at least 6 characters in length and SHALL be generated using an approved random bit generator [SP 800-90Ar1]."

Does user_password use an approved random bit generator? Can we simply hide the password_confirm element on user register forms when admin is creating a new user? Should we give a configuration option for this?

Comments

dnotes created an issue. See original summary.

  • dnotes committed 44b6a34 on 8.x-1.x 
    Issue #2904939 by dnotes: Provide means of generating initial passwords...
dnotes’s picture

dnotes commented
Status: Active » Fixed

Provided configuration options for never generating, optionally generating (hiding fields with javascript) or always generating passwords. Still not sure if user_password uses an "approved random bit generator" per NIST.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.