[
https://issues.apache.org/jira/browse/JSPWIKI-1254?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18138292#comment-18138292
]
ASF subversion and git services commented on JSPWIKI-1254:
----------------------------------------------------------
Commit f76267e6d8ebeb6934d27c4cd79887f5a4fe85e4 in jspwiki's branch
refs/heads/master from Arturo Bernal
[ https://gitbox.apache.org/repos/asf?p=jspwiki.git;h=f76267e6d ]
JSPWIKI-1254 Let passwords expire
jspwiki.credentials.expiry.days sets a number of days after which the password
of
a user of the wiki's user database has to be changed. It is off by default.
The date a password was last changed is now part of the user profile
(UserProfile.getPasswordChanged). The user databases set it when a profile is
saved with a password that is not the stored one, so hashing the same password
again, as happens at login when the algorithm or the iterations changed, does
not start the clock again. The XML user database keeps it in a new attribute.
The JDBC one needs a column, named by jspwiki.userdatabase.passwordChanged,
which
is optional so existing deployments keep working; the sample schemas have it,
and
a warning is logged if expiry is enabled without it.
At login, a user who gave the right password but whose password has expired is
not
logged in and is told so, in the session messages shown by Login.jsp. Only
someone who knows the password is told. The lost password feature or an
administrator sets a new one, which starts the clock again. A profile that has
no
date yet gets it at its next login, so that enabling the feature does not lock
everybody out at once.
The new message is in English in the bundles of the other languages until it is
translated.
> Support password expiration, password change reminders and account automatic
> lockout and eventual deletion
> ----------------------------------------------------------------------------------------------------------
>
> Key: JSPWIKI-1254
> URL: https://issues.apache.org/jira/browse/JSPWIKI-1254
> Project: JSPWiki
> Issue Type: New Feature
> Reporter: Alex O'Ree
> Assignee: Alex O'Ree
> Priority: Major
> Labels: pull-request-available
>
> applies to all wiki based authenticators (xml and jdbc database providers)
> all opt in features of course.
> after V days, dispatch an email that the password will expire soon,
> after X days, require a password change at login
> after Y days, lock an account from logins entirely, dispatching an email
> along with a warning of account deletion. to unlock, administrative
> intervention is required
> after Z days, delete an account permanently, dispatching an email
> after a period of W days without login and a new login is detected, dispatch
> an email to the account owner to confirm login
> and we'll probably need an admin tool for some of this
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
