I have created an enhancement request in Bugzilla for this proposal: http://nagoya.apache.org/bugzilla/show_bug.cgi?id=11736
I am also attaching my proposal document draft to this email. Comments and/or questions (if any) can be posted via the above link. Thanks! Best regards, Mark C. Orciuch Next Generation Solutions, Ltd. e-Mail: [EMAIL PROTECTED] web: http://www.ngsltd.com
Jetspeed Proposal: Password Validation and Expiration (draft) Version: $Revision: 1.1 $ Proposed by: Mark Orciuch, Next Generation Solutions, Ltd. ([EMAIL PROTECTED]) Status: Initial Proposal Date: September 11, 2002 Overview ======== The purpose of this proposal is to introduce the concept of password validation and automatic password expiration. Password validation allows to define custom set of rules to be enforced on passwords. Approach ======== My proposed approach is to track the date password was last changed. This could be done by one of the following: 1. A new column in TURBINE_USER table. 2. An attribute in user temp storage. Obviously there are pros and cons of both approaches but I would lean towards #1. I would like to put this up to a vote. The TurbineAuthentication class would be responsible for trapping the password expired event and throwing CredentialExpiredException. The JLoginUser would catch this exception and redirect the user to change password screen. I initially wanted to implement password validator functionality but, after giving it more thought, I decided to leave that functionality within TurbineUserManagement.changePassword method. Any custom password validation would be achieved by extending current implementation of CredentialsManagement. Implementation ============== 1. The following classes/templates would be changed: if new column is added, there would be a fair amount of changes to how the security database and peers are created. org.apache.jetspeed.om.security.JetspeedUser - add setPasswordChangedDate() and getPasswordChangedDate() methods. org.apache.jetspeed.om.security.BaseJetspeedUser - implement setPasswordChangedDate() and getPasswordChangedDate() methods. org.apache.jetspeed.services.security.turbine.TurbineUserManagement - modify changePassword() method to set password last changed date in JetspeedUser. org.apache.jetspeed.services.security.turbine.TurbineAuthentication - modify login() method to trap the password expired event and throw CredentialExpiredException. org.apache.jetspeed.modules.actions.JLogin - monitor for CredentialExpiredException and redirect to change-password screen WEB-INF/templates/vm/screens/html/change-password.vm - screen to prompt user for password change 2. The following entries would be added to the JetspeedSecurity.properties: # ------------------------------------------------------------------- # # UserManagement Services # # ------------------------------------------------------------------- .... # # Number of seconds until password expires. For example, # to force users to change their passwords every 30 days, # set it to 2592000 = 1 month (30*24*60*60). To disable # this feature, set it to 0. # # Default: 0 # services.JetspeedSecurity.password.expiration.period=0
-- To unsubscribe, e-mail: <mailto:[EMAIL PROTECTED]> For additional commands, e-mail: <mailto:[EMAIL PROTECTED]>
