arturobernalg opened a new pull request, #553: URL: https://github.com/apache/jspwiki/pull/553
This builds on #549 (JSPWIKI-1231), #550 (the lock of a profile) and #551 (the expiry of passwords), and the branch holds their commits. Only the last commit, "JSPWIKI-1254 Warn, lock and delete accounts as their passwords get old", is new here; this will shrink once those are merged. JSPWIKI-1254 is assigned to Alex O'Ree, so this should be agreed with them. On top of the expiry of the password (#551) there are three more optional stages, counted in days from the last change of the password. The property jspwiki.credentials.expiry.warnDays tells the owner by e-mail that the password is going to expire; it needs the expiry to be set and to be before it. The property jspwiki.credentials.lock.days locks the account and tells the owner; it stays locked until an administrator unlocks it. The property jspwiki.credentials.delete.days deletes the account and tells the owner. A stage that is not after the ones before it is logged and left off, so that a mistake in the settings cannot delete accounts earlier than intended. AccountLifecycle goes through the accounts once. AccountLifecycleThread runs it when the wiki has started and then every jspwiki.credentials.lifecycle.hours (24 by default), and ends with the wiki. A password that has no date gets it at the first pass, which is when its clock starts. The reminder is sent once per password, and again if it could not be sent. What has been done to an account stays done if the owner cannot be told, and the lock and the deletion are logged with an AUDIT prefix. All of it is off unless a number of days is set. AccountLifecycleMailer writes the e-mails with the new notification.credentials texts of the templates bundle. They are in English in all the languages until someone translates them. Nobody is written to who has no e-mail address. The user administration page shows whether a profile is locked, and UserBean unlocks it when it is given a new password. Unlocking without one would be undone at the next pass, as the password would still be old. Limits that I know of: the accounts are listed by wiki name, so a profile without one is not seen (the profiles created in the wiki always have it); the unlock checkbox is only in the default template, not in the 210 one; and I have not tried the page in a browser, only the bean behind it. Not part of this change, and still open in JSPWIKI-1254: the e-mail when someone logs in after a long time (it needs the date of the last login), and changing the password in the same login instead of resetting it. Tests: 27 in AccountLifecycleTest (the order of the stages and invalid settings, nothing happening when it is off, the clock starting, the reminder once and again for a new password, the lock, the deletion, a failure with one profile not stopping the others), 7 in AccountLifecycleMailerTest, 2 in AccountLifecycleThreadTest (no thread when there is nothing to do; the first pass and the stop with the engine) and 4 in UserBeanTest. The jspwiki-util, jspwiki-event and jspwiki-main suites pass. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
