On Monday, May 8, 2017 at 11:23:30 AM UTC-4, molly mcmanus wrote: > > In Dspace 5.x with regular password authentication. Is there a way to: > > 1. force more complex passwords > 2. disable the 'forgot password' (or change it so that it does not tell > you when an email address is valid) > 3. enable a lockout when a user tries using an incorrect password X number > of times >
There is nothing built in. 1. The tricky bit will be enabling the user interface to reject proposed credentials and ask again. How to do that will depend on whether you're using JSPUI or XMLUI. For example, in XMLUI, resources/aspects/EPerson/eperson.js#updatePassword is where checks are done, and if it doesn't like the password it can just return "password" to ask for another, but some message text may need to be expanded to explain the complexity requirement. 2. You should be able to comment out those controls in the user interface. 3. It shouldn't be hard to add a failure count to the EPerson record and increment it in dspace-api:org.dspace.authenticate.PasswordAuthentication on failure. The simplest approach might be to just fail without looking at the password when the count is above threshold, exactly as though the password were known to be incorrect, and send an administrator email whenever a count crosses threshold. That would require no UI changes, I think. You would still need some way for an administrator to reset the count. That could be added cheaply to the 'bin/dspace user' command (dspace-api:org.dspace.eperson.EPerson#main). -- You received this message because you are subscribed to the Google Groups "DSpace Technical Support" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. Visit this group at https://groups.google.com/group/dspace-tech. For more options, visit https://groups.google.com/d/optout.
