Mailing-List: contact users-help@directory.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@directory.apache.org
Received-SPF: pass (athena.apache.org: domain of elecharny@gmail.com
 designates 209.85.217.178 as permitted sender)
Message-ID: <50B6181C.5030006@gmail.com>
Date: Wed, 28 Nov 2012 14:56:44 +0100
From: =?UTF-8?B?RW1tYW51ZWwgTMOpY2hhcm55?= <elecharny@gmail.com>
Reply-To: elecharny@apache.org
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7;
 rv:17.0) Gecko/17.0 Thunderbird/17.0
MIME-Version: 1.0
To: users@directory.apache.org
Subject: Re: ApacheDS and password policy
References: <E2D47C214E2FA8408CAD51F676B586C5CDD009@EPHUBUDSA0036.epam.com>
In-Reply-To: <E2D47C214E2FA8408CAD51F676B586C5CDD009@EPHUBUDSA0036.epam.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Le 11/28/12 2:05 PM, Yevgen Ovchynnikov a écrit :
> Hello,
>
> As I can see from your page http://directory.apache.org/apacheds/1.5/account-and-password-policy-management.html , password policy and password strength are in future development, am I correct?

They are already available in 2.0.0-M8.

> If yes, could you please provide any tools or recommends how to implement password strength with ApacheDS? It will be great to your community.

The documentation is not yet ready, but for 2.0.0-M8, you have many
parameters you can set to manage the passwordPolicy in the
PasswordPolicies entry :
ads-pwdId=default,ou=passwordPolicies,ads-interceptorId=authenticationInterceptor,ou=interceptors,ads-directoryServiceId=default,ou=config

You have many possible parameters you can set.
> For example:
>
> -          Include at least one character from at least three of the following classes: lowercase letters, uppercase letters, numerals, punctuation (for example, #, |, $, %    and spaces)
>
> -          Are not found in common dictionaries, and are not well-known or predictable phrases
>
> -          Do not resemble the name of the account holder

Some of those checks are done through the DefaultPasswordValidator, but
not all of them. We need to add some more validators.
Hope it helps...

-- 
Regards,
Cordialement,
Emmanuel Lécharny
www.iktek.com