[
https://issues.apache.org/jira/browse/JSPWIKI-1254?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18135870#comment-18135870
]
Arturo Bernal commented on JSPWIKI-1254:
----------------------------------------
Three pull requests that build on each other, and on
https://github.com/apache/jspwiki/pull/549 (JSPWIKI-1231), are open.
https://github.com/apache/jspwiki/pull/550: the lock of a user profile works (a
locked profile can no longer log in, and the XML and JDBC user databases keep
the lock expiry correctly); the pull request describes the three problems that
I reproduced with tests. https://github.com/apache/jspwiki/pull/551: the
property jspwiki.credentials.expiry.days makes passwords expire, off by
default, and the date of the last change of the password is part of the user
profile. https://github.com/apache/jspwiki/pull/553: optional stages counted in
days from the last change of the password, to warn the owner by e-mail
(jspwiki.credentials.expiry.warnDays), to lock the account
(jspwiki.credentials.lock.days) and to delete it
(jspwiki.credentials.delete.days). The tests of each pull request pass on its
branch and do not pass on master.
> Support password expiration, password change reminders and account automatic
> lockout and eventual deletion
> ----------------------------------------------------------------------------------------------------------
>
> Key: JSPWIKI-1254
> URL: https://issues.apache.org/jira/browse/JSPWIKI-1254
> Project: JSPWiki
> Issue Type: New Feature
> Reporter: Alex O'Ree
> Assignee: Alex O'Ree
> Priority: Major
> Labels: pull-request-available
>
> applies to all wiki based authenticators (xml and jdbc database providers)
> all opt in features of course.
> after V days, dispatch an email that the password will expire soon,
> after X days, require a password change at login
> after Y days, lock an account from logins entirely, dispatching an email
> along with a warning of account deletion. to unlock, administrative
> intervention is required
> after Z days, delete an account permanently, dispatching an email
> after a period of W days without login and a new login is detected, dispatch
> an email to the account owner to confirm login
> and we'll probably need an admin tool for some of this
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
