topic Re: set password auto expiration in Alfresco Forum

set password auto expiration

monicakumari — Wed, 29 Nov 2017 11:03:16 GMT

Hello everyone. I am trying to do something like - All user passwords should expire every 90 days. Users should be forced to reset their expired passwords upon login to share with last password.anybody have any idea, how to do it ?thanks in advance.

Re: set password auto expiration

afaust — Wed, 29 Nov 2017 21:56:03 GMT

As always with any functionality that is not provided out-of-the-box you need to do significant custom implementation to achieve this. Luckily, Alfresco already provides the Java-level API to manage, store and validate expiration dates on authentications. Whenever a user is created or a new password is set, you could use a policy / behaviour to automatically set the expiration date back to 90 days in the future.

With that in place, you'd "only" need to implement all the missing UI functionality, i.e. displaying expiration reminders and handling the password change prompt. Unfortunately, since Alfresco is a web application, you cannot force users to change their password - I mean, you can force the dialog upon them, but they can always opt not to change the password by simply closing the browser, or they could use browser tools to hide / disable the popup.

Re: set password auto expiration

monicakumari — Tue, 02 Jan 2018 08:47:55 GMT

Thank you so much for your help. I have tried something -

I have created a behaviour to set a custom date(90 days from current date) to property ContentModel.PROP_CREDENTIALS_EXPIRY_DATE.

        Calendar now = Calendar.getInstance();
       now.add(Calendar.DATE, 90);
       passwordExpiryDate = now.getTime();

nodeService.setProperty(nodeRef, ContentModel.PROP_CREDENTIALS_EXPIRY_DATE, passwordExpiryDate);

and then trying to fetch this property just to check whether it is set or not.

logger.debug("PROP_CREDENTIALS_EXPIRY_DATE : " + nodeService.getProperty(nodeRef, ContentModel.PROP_CREDENTIALS_EXPIRY_DATE));

it is showing the correct value on console.

then, I have created a sceduler to run a .js file everyday to fetch this property. Its showing null.

not sure, why its showing null if the proprty is alredy set.

then, to check this I did

       Calendar now = Calendar.getInstance();
       now.add(Calendar.DATE, 90);
       passwordExpiryDate = now.getTime();

nodeService.setProperty(nodeRef, ContentModel.PROP_CREDENTIALS_EXPIRY_DATE, passwordExpiryDate);

to another java file (which triggers when a new user is created) and

logger.debug("PROP_CREDENTIALS_EXPIRY_DATE : " + nodeService.getProperty(nodeRef, ContentModel.PROP_CREDENTIALS_EXPIRY_DATE));

to the same behaviour.

now property PROP_CREDENTIALS_EXPIRY_DATE is setting while creating a new user, but when behaviour triggers, logs is showing NULL value.

don't know what mistake I am doing, whether PROP_CREDENTIALS_EXPIRY_DATE property can directly be used or not. If yes, then how.

could you please help me with this.

Please let know If there is another way to do it or this way is correct and I am making some mistake.

thanks in advance.

Re: set password auto expiration

afaust — Tue, 02 Jan 2018 09:37:04 GMT

Keep in mind that there are two nodes for each locally-maintained user. A cmerson node (which also exists for LDAP/AD synchronised users) which is accessed by most APIs, and the usr:user which contains the local authentication data (password + expiry). So be careful which of these two nodes you are accessing in your code.

Re: set password auto expiration

monicakumari — Tue, 02 Jan 2018 10:19:31 GMT

yes, thank you.. I have checked, the custom behaviour is having a user type nodeRef and the another class is having a person type nodeRef.

so, How do I get the user type nodeRef from a person type nodeRef ? do you have any idea ? which API can help me to get this ?

Re: set password auto expiration

monicakumari — Tue, 02 Jan 2018 13:10:51 GMT

Thanks alot. I can see the correct values on node browser.

I need on more help. I am trying to fetch " usr:credentialsExpiryDate " property through javascript. but I am getting null in it.

get-Details.js

var user;
var nodes = people.getPeople(null);
for each(var node in nodes)
{
logger.log(node);
user = utils.getNodeFromString(node);
logger.log(user.properties["cm:userName"] + " '"
+ user.properties["cm:firstName"] + "' '"
+ user.properties["usr:credentialsExpiryDate"] + "'");
}

the other two properties are showing correct values on console. but usr:credentialsExpiryDate is showing null.

I think this is again the nodeRef issue.

do you have any idea how to fetch usr:credentialsExpiryDate through javascript ?

Re: set password auto expiration

afaust — Tue, 02 Jan 2018 13:13:28 GMT

You should ideally never touch the node of type usr:user directly. There is MutableAuthenticationDao (bean "authenticationDao") which provides access to all you need, e.g. operations that take a user name as identifier and check / retrieve / set the expiration time.

Re: set password auto expiration

monicakumari — Fri, 05 Jan 2018 13:52:36 GMT

Thank you so much for you help.. I dove done what I was trying to do. But I have a issue - not exactly an issue but may be, it might create some issue .

I have created a behaviour "CheckPasswordExpiration.java" to set password expiration date and a scheduler to check the expiration date on daily basis. there was no issue till I created the scheduler.

there is an another seperate behaviour "GenerateEmails.java" which runs when a new user is created just to send mail notifications.

when I created the scheduler, a javascript file (to send email notification) and whenever it triggers, the another seperate behaviour "GenerateEmails.java" automatically triggers which is showing exception.

2018-01-05 14:35:00,439 ERROR [quartz.core.ErrorLogger] [DefaultScheduler_Worker-1] Job (jobGroup.jobD threw an exception.
org.quartz.SchedulerException: Job threw an unhandled exception. [See nested exception: org.alfresco.error.AlfrescoRuntimeException: 00050016 Failed to execute transaction-level behaviour public abstract void org.alfresco.repo.node.NodeServicePolicies$OnCreateNodePolicy.onCreateNode(org.alfresco.service.cmr.repository.ChildAssociationRef) in transaction a187771c-4769-4d88-807c-f97f335913ce]
   at org.quartz.core.JobRunShell.run(JobRunShell.java:227)
   at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:563)
Caused by: org.alfresco.error.AlfrescoRuntimeException: 00050016 Failed to execute transaction-level behaviour public abstract void org.alfresco.repo.node.NodeServicePolicies$OnCreateNodePolicy.onCreateNode(org.alfresco.service.cmr.repository.ChildAssociationRef) in transaction a187771c-4769-4d88-807c-f97f335913ce
   at org.alfresco.repo.policy.TransactionBehaviourQueue.execute(TransactionBehaviourQueue.java:255)
   at org.alfresco.repo.policy.TransactionBehaviourQueue.beforeCommit(TransactionBehaviourQueue.java:134)
   at org.alfresco.util.transaction.TransactionSupportUtil$TransactionSynchronizationImpl.doBeforeCommit(TransactionSupportUtil.java:535)
   at org.alfresco.util.transaction.TransactionSupportUtil$TransactionSynchronizationImpl.doBeforeCommit(TransactionSupportUtil.java:514)
   at org.alfresco.util.transaction.TransactionSupportUtil$TransactionSynchronizationImpl.beforeCommit(TransactionSupportUtil.java:479)
   at org.springframework.transaction.support.TransactionSynchronizationUtils.triggerBeforeCommit(TransactionSynchronizationUtils.java:95)
   at org.springframework.transaction.support.AbstractPlatformTransactionManager.triggerBeforeCommit(AbstractPlatformTransactionManager.java:925)
   at org.springframework.transaction.support.AbstractPlatformTransactionManager.processCommit(AbstractPlatformTransactionManager.java:738)
   at org.springframework.transaction.support.AbstractPlatformTransactionManager.commit(AbstractPlatformTransactionManager.java:724)
   at org.springframework.transaction.interceptor.TransactionAspectSupport.commitTransactionAfterReturning(TransactionAspectSupport.java:475)
   at org.alfresco.util.transaction.SpringAwareUserTransaction.commit(SpringAwareUserTransaction.java:482)
   at org.alfresco.repo.transaction.RetryingTransactionHelper.doInTransaction(RetryingTransactionHelper.java:479)
   at org.alfresco.repo.transaction.RetryingTransactionHelper.doInTransaction(RetryingTransactionHelper.java:326)
   at org.alfresco.repo.action.scheduled.AbstractScheduledAction$JobDefinition$1.runTransactionalAction(AbstractScheduledAction.java:557)
   at org.alfresco.repo.action.scheduled.AbstractScheduledAction$JobDefinition$1.doWork(AbstractScheduledAction.java:426)
   at org.alfresco.repo.security.authentication.AuthenticationUtil.runAs(AuthenticationUtil.java:548)
   at org.alfresco.repo.action.scheduled.AbstractScheduledAction$JobDefinition.execute(AbstractScheduledAction.java:392)
   at org.quartz.core.JobRunShell.run(JobRunShell.java:216)

this behaviour must not trigger when this javascript run through scheduler.

do you have any idea, why this is happening. I can provide you any another information if you need.

thank you.

Re: set password auto expiration

afaust — Fri, 05 Jan 2018 15:06:28 GMT

I am totally NOT a fan of transaction-level behaviours for precisely these kinds of issues that most people, who are not Alfresco experts, run into. I would assume your GenerateEmail.java behaviour is simply bound to an incorrect policy (not just on create but also on update), or may not work with the specific authentication context (runAs some user X). Unfortunately, that log output (and lack of configuration XML for reference) is not enough to remote-guess the issue.

Re: set password auto expiration

monicakumari — Sat, 06 Jan 2018 06:38:04 GMT

Thank you for your help and quick response. I really appriciate it.

Axel, I don't know which XML configuration is it.

These are all the files (attached)I have created. don't know why this is happening.

PasswordExiration-notification.js - scheduler javascript file to check password expiration on daily basis and send mail notifications.

PasswordExpirationCheck.java - this behaviour triggers when the password is updated or created a new user just to set password expiration true and the no. of days. both the value will get from alfresco-global.properties file.

GenerateNewUserWelcomeEmail.java - this was created to trigger when a new user is created. this behaviour is triggering automatically when the scheduler triggers. which must not and throwing some all those exceptions.

sevice-context.xml

alfresco-global.properties file.

Re: set password auto expiration

afaust — Sat, 06 Jan 2018 16:30:12 GMT

Unfortunately, none of these files show how the password expiration JS is being registered / triggered. So far, nothing provides any clues to what kind of OnCreateNode behaviour is being triggered or what the specific error is in that case. Judging from the Alfresco source code of TransactionBehaviourQueue, you should have way more information in the log than you have provided so far, so maybe if you could also provide the full alfresco.log for that error, it could help.

I am curious: How is that password expiration notification JS working, I mean doing the search.luceneSearch() on the Alfresco user store, when it is not indexed by default? Did you add extra cores to SOLR for that? Also, luceneSearch is a very old-school, legacy way to search and has not received any optimsiations since 4.0. Furthermore, processing ALL users in one JS action is quite a massive job - what if the process fails for a single user? Does it start over again, and send duplicate mails to all the users that have already been processed? You may also overwhelm the caches by processing too many users in a single transaction.

Re: set password auto expiration

monicakumari — Mon, 08 Jan 2018 05:17:49 GMT

The javascript file is running using scheduler(attached). currently javascript is working fine. I have tested multiple times with three users. the only issue is when the scheduler triggers, the onCreateNode behaviour(GenerateNewUsersMail.java) triggers automatically, which should not. This is not creating any impact but I think It may create issue in future.

thanks.

Re: set password auto expiration

monicakumari — Wed, 24 Jan 2018 10:22:26 GMT

Hello Axel,

you were correct. I was able to do it with sdk 2.2, but not able to search user properties (prefix : usr) with latest sdk.

I am getting exceptions :

Failed to execute search: @usr\:username:*

Caused by: org.alfresco.repo.search.impl.lucene.LuceneQueryParserException: 00240096 No solr query support for store user://alfrescoUserStore

could you please help me with the other way to search users instead of search.luceneSearch("user://alfrescoUserStore", "@usr\\:username:\*");

I need the user properties from user node.

Thanks.

Re: set password auto expiration

monicakumari — Tue, 01 Oct 2019 06:35:17 GMT

this worked..

var userNodeQuery = "TYPE:\"usr:user\"";
	var userNodeQueryDef = {
		       query: userNodeQuery ,
		       language: "fts-alfresco" ,
			   store: "user://alfrescoUserStore"
		};
	
	userNodes = search.query(userNodeQueryDef);

Re: set password auto expiration

shivananda_L — Wed, 10 Apr 2024 07:00:40 GMT

"Good day.

I am interested in implementing a feature for password auto-expiration within Alfresco.

@monicakumari wrote:

this worked..

var userNodeQuery = "TYPE:\"usr:user\"";
	var userNodeQueryDef = {
		       query: userNodeQuery ,
		       language: "fts-alfresco" ,
			   store: "user://alfrescoUserStore"
		};
	
	userNodes = search.query(userNodeQueryDef);

This feature would prompt users to change their passwords after a period of 60 days. Could you please provide guidance on how to implement this functionality?

Thank you