freeipa

#5948 [RFE] Implement pam_pwquality featureset in IPA password policies
Closed: fixed by rcritten. Opened by pvoborni.

Closed: fixed
Reopen Issue

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 7): Bug 1340463

Description of problem:
At the moment "Password123!" is a valid password when a user chooses a new
password. This needs to be changed.
It would be great if we can have at least dictionary checks implemented on a
quite short term and on the long term the complete featureset of pam_pwquality
Version-Release number of selected component (if applicable):
4.3

Metadata Update from @pvoborni:
- Issue assigned to someone
- Issue set to the milestone: Future Releases

This work is almost complete in 389 Directory Server:

https://pagure.io/389-ds-base/issue/49794

Once this is done and fully tested it should be easy to port this to FreeIPA's password policy plugin

We are also going to pursue the socket activated script (external syntax checker) in DS 1.4.1 via:

https://pagure.io/389-ds-base/issue/49865

master:

  • 41021c278ae572ff5b1b3dea828a7dd93fe1ffff Add LDAP schema for new libpwquality attributes
  • 6b452e54045bb957e6f787209b4498eefc5df779 Extend IPA pwquality plugin to include libpwquality support
  • c03b4862b84d52ddc91c5a3fb885b0ebf753d8f2 Add new pwpolicy objectclass to test_xmprpc/objectclasses.py
  • 3fc2eda4e15e9592132062036d70acad3bab401c Require libpwolicy and configure it in the build system
  • c4cca53e88e78bfe512ebe59898ede0f94ec24ff Extend password policy to evaluate passwords using libpwpolicy
  • 46d0096218488a961125b6d97a9210b68e5434e5 Add a unit test for libpwquality-based password policy
  • 6da070e655c5d084a825607ed3be604c809b12f0 Pass the user to the password policy check in the kdb driver
  • be2efc12d37018794200fee874f27d83e0442ea4 Add a raiseonerr option to ldappasswd_user_change
  • fe44835970eca197543eb3c908c51a240204d846 ipatests: add test for password policies
  • 68aa7c05542422aca05bec4967133be09a32496e Add SELinux policy so kadmind can read the crackdb dictionary
  • f602da4b28fcf8822225b80df241eed6b624bf8e Requirements and design for libpwquality integration
  • 5155280bb4a92eb3dfdee5ca3f3a332f0159d568 ipatests: Add test_pwpolicy to nightly runs

ipa-4-8:

  • 04c34dcb33fa2e1ed6103250257c00e03ad93a22 Add LDAP schema for new libpwquality attributes
  • e8232dd0846963b1af7dc96ddbc99c75ef8333d5 Extend IPA pwquality plugin to include libpwquality support
  • 4dcb8d98e100d1fad89600b312b301e87d79f704 Add new pwpolicy objectclass to test_xmprpc/objectclasses.py
  • 734afe3896896a5633a926a4af08a58bceb966fd Require libpwolicy and configure it in the build system
  • 43cdcad24082bdb8356c44de78bfa69162e0ca6a Extend password policy to evaluate passwords using libpwpolicy
  • cba86e814d44169b0275f908a389b67ddc462ce7 Add a unit test for libpwquality-based password policy
  • d6a8fc290aa93fc5d53025f4400a9736366175eb Pass the user to the password policy check in the kdb driver
  • 676979eb510f71639ae0ccb16a44b75e3c084245 Add a raiseonerr option to ldappasswd_user_change
  • 9627ac4496cd3631250ed21e20157d41d27d6052 ipatests: add test for password policies
  • 60768b7344fcd0ad991ed1dc78c7a8f9784dc031 Add SELinux policy so kadmind can read the crackdb dictionary
  • 48801cba3ffb76ba01fa908b13a8ff400423793f ipatests: Add test_pwpolicy to nightly runs

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

master:

  • 26b9a697844c3bb66bdf83dad3a9738b3cb65361 Wrap libpwquality PKG_CHECK_MODULES in ENABLE_SERVER test

ipa-4-8:

  • 3e51d443a659513767dffc2b00920004a81e2ef1 Wrap libpwquality PKG_CHECK_MODULES in ENABLE_SERVER test
Metadata
None
None
None
Normal
enhancement
DS plugins
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.