Email user when password expires

Moving to needs review

Can we make this configurable?

As it's not the current behavior, I could see how people may or may not want to use this feature.

Thanks for the patch @thepractice. I wasn't able to apply it successfully. It kept failing for me and I finally figured out it was because the "use Drupal\Core\Url;" class at the top of the file was getting rejected. The reason it was getting rejected for me was because it was trying to apply this after a class that my version wasn't using. For example, the patch has:

use Drupal\user\Entity\User;
use Drupal\Core\Url;

but the module did not have use Drupal\user\Entity\User; in it. So the patch was trying to apply use Drupal\Core\Url; after something that wasn't there. I just added this all in locally and recreated the patch (see attached patch). However, when I test this functionality it's not working for me. What steps should I be following to make sure I'm testing correctly? At the moment I am setting the "password expiration" option and applying a policy to expire after 30 days. I am manually setting the date to a month back so I get an expiration notice locally on the site, but I am not getting an email. Maybe I am doing something wrong?

Hope this all makes sense. Thanks for the help!

This may be nitpicks, but we can have the t function process the link token as a parameter:

$params['message'] = t('Your password has expired. Please visit the following link to reset your password: ') . $link;

to something like:

$params['message'] = t('Your password has expired. Please visit the following link to reset your password: :link', [ ':link' => $link ]);

Also, I still want to see this as a configurable option not enabled by default.

I think ideally it would be possible to send expiration warning emails ahead of expiration too. See #2872681: Email user when the password is about to expire.

Needs work per #8 (with which I agree).

Here's a patch that uses a passed in argument for the message and makes sending an email a configurable option.

I have another patch. This one also allows sending an email notifying a user of a pending password expiration.

Current patch doesn't take into account if the module is already installed, in which case 'field_pending_expire_sent' will never be found and eventually EntityStorageException will be trigged. Appended a hook_update_N to .install for the same.
(There is an existing hook_update_N with incorrect name though in 8.x-3.x which I've not touched for now)

Adding missing files :P

I found two issues. I forgot to check the pending email sent field so it emails the pending expiration unfortunately on every cron. I also found that password_policy_update_8301() fails. It looks like the yml files for the pending field were missing. I added them.

Johne,

I tried your patch and it was successful. What's the process on getting this into the main branch?

@thetailwind If you found that the patch worked for you. Please feel free to leave a review with steps you took to validate and move the issue to "Reviewed and Test by the Community" in the Status dropdown.

I reviewed the email-expire-and-pending-2997543-15.patch patch and installed it on my site.

I created a password policy that expires users every 60 days and notifies them once their password has 7 days of validity left.
I modified a user so that their last password reset fell within the criteria defined by the password policy because I had no accounts that are naturally expiring soon. I successfully got an email notifying me that my password will expire in 7 days.

In my humble opinion, this really needs tests. Tests were lacking for this feature in 7.x-1.x, there were (are?) bugs, and adding tests retroactively has been a lot of work.

#15 doesn't work with latest dev build so updating patch.

Patch #20 fails when adding new users. InvalidArgumentException: Field field_pending_expire_sent is unknown.

The hook_update_N needs to include adding these new fields to the user Entity.

@nmudgal @DanielVeza Had a go at fixing the user creation error + added support for multiple email notifications.

Hi everyone,

I rerolled the patch since the hook_update doesn't execute, and sends an error "Field field_pending_expire_sent does not exist".

The hook_update now imports all module config, and creates the field.

Thanks for your work, I'll test it now !

Regards,
Barig

Looks like my previous patch was wrong... Hope new one will be ok

This one finally applied... Sorry for the spam, I don't get why my git command created an invalid patch.

Another one with a deprecation fixed on .module.

I worked a bit more on the patch, so now it works properly for sending multiple notifications (previous patch was only sending the first notification, and no other until the password was expired).

Now it sends notifications and stores on the new field the value of the "period" the mail has been sent for (let's say password expires in 10 days, and mail has been sent). So when time goes and new period is matched (let's say, 5 days left before expiration), it sends new mail and stores "5" as the last "period" mail has been sent. Etc.

Hope it helps.

Regards,
Barig

Working on it.

I added test coverage to the patch and fixed some scheme problems.

Setting back a peace of code that was unnecessarily removed in #29.

Adding missed scheme.

Hey Paulocs!

So far I set up and saved it without any errors, but I won't be able to test if I will receive a notification or not because I don't want all my users to receive this out of nowhere. Also, I was wondering if this patch is also compatible with D9 since D8 is going deprecated in Nov?

EDIT: on a smaller site, I set my password to reset in 15 days and to warn my users on 1,7,14 days. Hopefully, I'll get a warning tomorrow.

Thanks!!

Yes, the patch is compatible with Drupal 9.
You can test it with https://www.drupal.org/project/maillog if you don't want to send email.

After applying patch from #33 I can't create a new user, even without creating a password policy.
Changing to Needs Work.

Did you run update.php after you've applied the patch?

Hey Paulocs,

I didn't receive any expiration emails. I asked my network admin if they were blocked, but don't see anything either.

Thanks!

Hello!
I ran the update.php now and tested the patch, and it worked for me.
I've created a password policy with 5 days expiration time and 4 days to send the email. After that I updated the user to have it's "Last Password Reset" 2 days ago, and run Cron. The email was sent.

Important thing: if the password has already expired, the email will not be send, and if we set to send a email 4 days before it expires but for some reason you don't run Cron (eg you didn't entered the site), it will send the email the next time Cron is run. ( eg. it should sent a email yesterday but you just entered your site today, it will send a email today (if the password didn't expire)

I'm not changing it to RTBC to see what happened on #38.

I will test it again. Thanks for the tip hmendes!

@hmendes. I tested it and it worked!

Is it RTBC?

Hey guys,

I tested it on another site and my link is incorrect. I got this:

Your password has expired. Please visit the following link to reset your
password: http://default/user/login

It should direct me to my website URL.

Thanks!

@Sseto - Have you tried other emails? That feels like an issue unreleated to this.

I actually tested it with all my colleague's accounts and they all received the same incorrect URL.

Any idea what could be the issue?

Thanks!

Hi @Sseto,
this problem is because you are running cron with Drush, right?
You should add the --uri parameter to the Drush command to set the right domain.

https://atendesigngroup.com/articles/does-using-drush-uli-d8-and-getting-httpdefault-drive-you-mad

Hey @paulocs

It does look similar to what I got, but I actually didn't even run drush or press the "run cron" button. I just set it to expire in 5 days and give me the warning in 4 days.

Could it be because the site is a D7 to D8 migration?

*EDIT: Could it also be that I didn't set up my [trusted_host_pattern] in settings.php too?

Thanks!

Hey guys!

I added the [trusted_host_pattern] and re-tested it and it works!!

`our password will expire in less than 4 days. Please visit the following
link to reset your password: https://devtest.sseto.ca/user/login`

Weird question...

For multiple notifications. Should I put a space after the comma? like 14, 7, 1 or 14,7,1?

Thanks!

Not sure but I think you can try it.
I'll see if I find something related.
Please let me know if you find any solution.

Hey Paulocs,

Received it! I set it to 4,3 (without spacing).

I did notice that when I clicked `edit` again, the settings changed to 3,4 (no spacing).

Everything looks good!!

Thanks for adding this feature!

Cool. Moving to RTBC because of #50.

Following. @paulocs Is this feature going to be available in the next stable release?

Hello @DrupalBDGirl,

I'm not a maintainer of this module yet. I requested to help as co-maintainer in #3219554: Help as co-maintainer, but I don't have permission to decide about it.
I've been in contact with @nerdstein so I sent him this issue. Let's see what he thinks about this feature.

Did you test the patch? Is it working as expected?

Hi Paulocs,

I applied the patch in #33 and run update.php. I have configured the password reset email settings but I have not received any email notification.
Password Reset Days: 9 days
'Send email upon password expiring' is checked
Send pending email days before: 1,2,3,4,5,6,7,8,9
Thank you!

Applied the patch from https://www.drupal.org/project/password_policy/issues/2997543#comment-14...
Ran db updates
password_policy module : 8302 - Import yaml config of `password_expire_sent` field.
Updated the policy to send notifcations.
Ran the cron
Email received.
RTBC

@joshua1234511 Could you please share the password_policy configuration for the site?
Thank you

@drupalbdgirl

id: password_policy_test
label: password_policy_test
password_reset: 90
langcode: en
policy_constraints:
  -
    id: password_length
    character_length: 8
    character_operation: minimum
  -
    id: character_types
    character_types: 4
  -
    id: password_policy_character_constraint
    character_count: 1
    character_type: uppercase
  -
    id: password_policy_character_constraint
    character_count: 1
    character_type: lowercase
  -
    id: password_policy_character_constraint
    character_count: 1
    character_type: numeric
  -
    id: password_policy_character_constraint
    character_count: 1
    character_type: special
send_reset_email: true
send_pending_email:
  - 7
roles:
  authenticated: authenticated
  administrator: administrator
  approver: approver
  site_admin: site_admin
  editor: editor
  previewer: previewer

@joshua1234511 Thank you!

This turned out really well. Thank you all for the hard work on it.