topic Re: Is it possible to configure system to constrain passwords? in Alfresco Archive

Is it possible to configure system to constrain passwords?

tdahlgren — Thu, 18 Oct 2007 23:35:11 GMT

I need to establish rules or constraints on passwords. For example, require a minimum number of characters in the password. Also, require at least one numeric character. Etcetera. Is this possible through any of the standard customization mechanisms for the community edition? If so, how?

Re: Is it possible to configure system to constrain passwords?

dhalupa — Fri, 19 Oct 2007 09:05:05 GMT

Yes, it is possible with regular expression constraint

http://wiki.alfresco.com/wiki/Constraints

Re: Is it possible to configure system to constrain passwords?

tdahlgren — Fri, 19 Oct 2007 15:22:44 GMT

Great! I was hoping that would be the case. I haven't dug into the Alfresco internals; rather, am relying primarily on extensions.

P.S. I'm using Alfresco 2.1 with Tomcat on Linux.

Re: Is it possible to configure system to constrain passwords?

dhalupa — Sat, 20 Oct 2007 11:13:18 GMT

Ups, sorry, I did not quite understand what you are trying to acheive..

I think that you can enforce constrains on password creation by changing ChangeMyPasswordDialog, ChangePasswordDialog and CreateUserWizard (perhaps that are more classes on the list) in org.alfresco.web.bean.users package. This is rather high level, if you would like to go lower try looking into classes which implement AuthenticationDAO interface.. Haven't done this myself, so take this advice with caution, but felt I have to answer since I allready gave you wrong information above

Re: Is it possible to configure system to constrain passwords?

andy — Mon, 29 Oct 2007 11:16:43 GMT

Hi

You would have to enforce password constraints in the DAO or authentication service. Constraints in the DD will not work as they will (most likely) apply to the password hash. You will also need to add the constraints in the UI (so as not to throw a nasty error).

Andy

Re: Is it possible to configure system to constrain passwords?

tdahlgren — Wed, 05 Mar 2008 23:16:36 GMT

My apologies for not following through on this months ago. I was advised (locally) to pursue an Active Directory-related solution so have not pursued this matter further.

Thank you both for the information, though!