Site administrators should be able to control password expiration rules for accounts. I think there are 2 ways we should support now: a number of days since last changed (e.g.
auth.pwdexpire.days = 180) and a force reset for everyone before a certain time (e.g.
auth.pwdexpire.before = 1401742705). They should be complimentary, so both settings could potentially be used at the same time. Default to no expirations.
This should rely on the AuthenticationProvider interface, so different implementations can record the field for last time a password was changed in their own way. I'm thinking perhaps each provider should be responsible for setting it within their
set_password and then have a new method to get that value for a given user. Then the logic & forms of this new feature can work with any auth provider. Implement as a mongo field for the LocalAuthenticationProvider. I think for the LDAP provider, we should use the same mongo field on the User model (storing in LDAP would be nice, but could require an LDAP schema change for admins and we have a mongo user record for everyone anyway).
Upon successful login, if a password is expired, require the user to change their password before continuing anywhere in the site. Using the existing
password_change_form seems good: requiring entering old password again and new one twice.
Log in to post a comment.