Initially raised here #1921356: Password policy not enforced on creation of users, but I don't think the OP was really addressed. What if the policy only applies to certain roles, not all authenticated users? In our case, we only want to enforce stronger passwords on admin accounts, so that's how our policy is set up. I understand it not applying the policy on the page initially when you're filling out the form, but it should at least be added as one of the validation handlers when submitting the admin user creation form...?

CommentFileSizeAuthor
#11 password_policy-7.x-1.x-allow_excluding_authentication_modules-2872688-11.patch11.75 KBaohrvetpv
#10 password_policy-7.x-1.x-apply_policies_for_chosen_roles_when_administering_user-2833455-10.patch10.8 KBaohrvetpv
#9 password_policy-7.x-1.x-apply_policies_for_chosen_roles_when_administering_user-2833455-9.patch10.79 KBaohrvetpv
#8 interdiff-2833455-7-8.txt2.46 KBaohrvetpv
#8 password_policy-7.x-1.x-apply_policies_for_chosen_roles_when_administering_user-2833455-8.patch4.46 KBaohrvetpv
#7 password_policy-7.x-1.x-apply_policies_for_chosen_roles_when_administering_user-2833455-7.patch5.23 KBaohrvetpv
#6 password_policy-7.x-1.x-enforce_policies_for_new_user_roles-2833455-6.patch3.52 KBaohrvetpv

Comments

scotself created an issue. See original summary.

aohrvetpv’s picture

aohrvetpv commented
Version: 7.x-1.12 » 7.x-1.x-dev
Category: Feature request » Bug report

Looks like a bug to me. When a user creates another user via admin/people/create, seems like either:
a. The password policies of the user creating a user should apply.
b. The password policies that apply to the initial roles of the created user should apply.

(b) seems more the proper solution to me, but (a) might be preferable to give administrators the ability to override password policies. Thoughts?

scotwith1t’s picture

scotwith1t
Location Birmingham, AL
commented

If the check is added as a validation handler when the user edit form is submitted, it can check the roles that are given to the user on save and validate based on rules.

aohrvetpv’s picture

aohrvetpv commented

This should perhaps be solved more generally by enforcing password policies for all account password elements, regardless of what form they are on:
#2562481: Apply password policies to account password elements on custom forms

aohrvetpv’s picture

aohrvetpv commented

The patch in #2562481-19: Apply password policies to account password elements on custom forms will make it so the password policies of the current user are enforced when creating a new user.

Ideally the password policies that apply to the select roles would be applied. That would require changes to the password checking JavaScript as well as the PHP that checks the form submission against policies.

aohrvetpv’s picture

aohrvetpv commented
StatusFileSize
new password_policy-7.x-1.x-enforce_policies_for_new_user_roles-2833455-6.patch3.52 KB

This initial patch might work for applying policies to administrator-registered new users based on the roles they are assigned.

Needs more work to apply policies to administrator-edited existing users based on their roles.

I refactored password_policy_password_validate() into many small functions to lessen my confusion working with the code.

aohrvetpv’s picture

aohrvetpv commented
Status: Active » Needs review
StatusFileSize
new password_policy-7.x-1.x-apply_policies_for_chosen_roles_when_administering_user-2833455-7.patch5.23 KB

This patch enforces policies that apply to the roles selected when an administrator registers a new user or edits an existing one.

Please review/test.

aohrvetpv’s picture

aohrvetpv commented
StatusFileSize
new password_policy-7.x-1.x-apply_policies_for_chosen_roles_when_administering_user-2833455-8.patch4.46 KB
new interdiff-2833455-7-8.txt2.46 KB

Changed logic so this new behavior will hopefully also apply to passwords on custom forms. For instance, if the Password Tab module is enabled and an administrator changes another user's password via the password tab, the roles of that user should be used for validating constraints.

Also fixed a minor bug with #7 and changed some wording.

Please review/test.

aohrvetpv’s picture

aohrvetpv commented
StatusFileSize
new password_policy-7.x-1.x-apply_policies_for_chosen_roles_when_administering_user-2833455-9.patch10.79 KB

Added test to #8.

Please give feedback. Will plan to commit soon.

aohrvetpv’s picture

aohrvetpv commented
StatusFileSize
new password_policy-7.x-1.x-apply_policies_for_chosen_roles_when_administering_user-2833455-10.patch10.8 KB

Minor wording change in test added by #9.

aohrvetpv’s picture

aohrvetpv commented
StatusFileSize
new password_policy-7.x-1.x-allow_excluding_authentication_modules-2872688-11.patch11.75 KB

disregard, wrong issue

aohrvetpv’s picture

aohrvetpv commented

  • AohRveTPV committed e18c996 on 7.x-1.x 
    Issue #2833455 by AohRveTPV: Admin user creation, policies not enforced...
aohrvetpv’s picture

aohrvetpv commented
Status: Needs review » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.