Administrators always bypass password policies

I'm a bit hesitant to add a new permission, and suspect of the original bypass password policies permission. It seems the solution for the bypass policies permission is to configure policies to not capture that role. It makes the configuration less meaningful if there is a permission that contradicts the policy configuration, and harder to solve problems such as identifying when password policy validation should occur.

There is valid a use case to allow users with (a new) permission to edit other user profiles without password policy validation running: https://www.drupal.org/node/2786315. The original proposed solution seems appropriate, but also removing the bypass password policy permission is probably for the best. Let me know your thoughts, thanks.

I agree with mroycroft that removal of the "Bypass password policies" is best.

In our use case, we have three users having the Administrator role. We want to enforce the password policy for this role, but the "Bypass password policies" permission for the Administrator role is selected and disabled.

This issue should be resolved by #2849271: Decouple display of policy table and policy validation. It made sense to handle it there since that ticket was also addressing issues with when password policy validation should occur.

I'm in complete agreement for the removal of this permission. For a role to "bypass" password policy, it should just not have a password policy. Seems unnecessary and error prone to have a permission which basically means "ignore this module". This issue is further compounded by the User 1 always having all permissions, so user 1 will always bypass password policy.

I don't necessarily agree that this should be done in #2849271: Decouple display of policy table and policy validation. It does seem mildly convenient for that patch, but the issue isn't related to the permission enough directly. I think it'd be better to do the work in a dedicated issue such as this one: #2862906: Remove "bypass password policies" permission

Thanks to everyone for the work on this issue.

I'm going through all the 8.x issues.

Since #2862906: Remove "bypass password policies" permission has been fixed, closing this as duplicate per #8.