Project

General

Profile

Actions
Copy link

Defect #1832

closed

Generating password doesn't set new valid till

Added by Ondřej Kopr over 4 years ago. Updated over 3 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Peter Štrunc
Target version:
2.1.0
Start date:
09/03/2019
Due date:
% Done:

100%

Estimated time:
Affected versions:
2.0.0, 1.7.0
Owner:

Description

It is required set new password valid till during password generate. Without this setup we generate infinity valid password for users.

As temporary workaround can be used this settings:

idm.sec.core.processor.identity-password-processor.eventTypes=PASSWORD, PASSWORD_RESET,PASSWORD_GENERATE

but this configuration also generate one history password record.

Actions
Copy link
 #1

Updated by Ondřej Kopr over 4 years ago

  • Target version changed from 1.6.0 to 1.7.0
Actions
Copy link
 #2

Updated by Ondřej Kopr over 4 years ago

  • Status changed from New to In Progress
Actions
Copy link
 #3

Updated by Ondřej Kopr over 4 years ago

  • Status changed from In Progress to Needs feedback
  • Assignee changed from Ondřej Kopr to Peter Štrunc
  • % Done changed from 0 to 90

I finally solve this issue. After some tests was founded that even for password reset isn't set valid till into password.

So in version before 1.7.0 is after password reset setup password without expiration and user has infinity passwords.

Both places was updated:
commit: https://git.bcvsolutions.eu/modules/password-reset/commit/8ba0f81bb20abdb7f39f84dba60e3af52126c9b1 (branch: develop)

I was little bit stuck with test, because test properties missing and application was asynchronous. I added this properties with logback:

commit: https://git.bcvsolutions.eu/modules/password-reset/commit/3b5d86be9e7e05b235761bb8a9e1e9f40de0ecf2 (branch: develop)

Documentation with information about password expiration was added: https://wiki.czechidm.com/devel/documentation/modules_pwd

Please Peter could you make a review?

Actions
Copy link
 #4

Updated by Ondřej Kopr over 4 years ago

I also fix jenkins, because this project has old build commnad on jenkins:

Old:

-U -Dmaven.wagon.http.ssl.insecure=true -Djavax.net.ssl.trustStore=/home/jenkins/.m2/lets_cacerts  -PseparatedApp clean verify sonar:sonar install deploy

New:

-U -Dmaven.wagon.http.ssl.insecure=true -Djavax.net.ssl.trustStore=/home/jenkins/.m2/lets_cacerts  -Ptest -Dspring.profiles.active=test clean verify sonar:sonar install deploy

Actions
Copy link
 #5

Updated by Peter Štrunc over 4 years ago

  • Status changed from Needs feedback to In Progress
  • Assignee changed from Peter Štrunc to Ondřej Kopr

It looks great. I would also like to add this fix to version 2.0.0, but there are some incompatible changes (using joda.time). Please keep this fix in develop, we will release version 1.7.0 with it. The please add this fix on 2.0.0-rc, but make it compatible with core 10.0.0.

Actions
Copy link
 #6

Updated by Ondřej Kopr about 4 years ago

  • Status changed from In Progress to Needs feedback
  • Assignee changed from Ondřej Kopr to Peter Štrunc
  • Priority changed from High to Normal

I have little issue after i switch to actual develop. So I made these changes: https://git.bcvsolutions.eu/modules/password-reset/commit/524aeca1d70f3a317412627161c293113bbe2b33

The error:

SLF4J: See http://www.slf4j.org/codes.html#multiple_bindings for an explanation.
Failed to instantiate [ch.qos.logback.classic.LoggerContext]
Reported exception:
java.lang.NoSuchMethodError: ch.qos.logback.core.rolling.SizeAndTimeBasedFNATP.<init>(Lch/qos/logback/core/rolling/SizeAndTimeBasedFNATP$Usage;)V

After project was updated to version 10 the folder was changed (backend/ -> backend/idm-pwdreset/). I changed also patch on jenkins.

Commit with upgrade this feature to version 10: https://git.bcvsolutions.eu/modules/password-reset/commit/1acf7f448898c869412c42c0331b234731b1d2f2 (develop)

Please @sourek could you check tests if the module works correctly? Thank you :)

Actions
Copy link
 #7

Updated by Peter Štrunc over 3 years ago

  • Target version changed from 1.7.0 to 2.1.0
  • Affected versions 2.0.0, 1.7.0 added
Actions
Copy link
 #8

Updated by Peter Štrunc over 3 years ago

  • Assignee changed from Peter Štrunc to Ondřej Kopr

I fixed password reset and generating of new password. Now it uses default validation policy instead of generate policy. @kopro would you please review these changes? Everything is in develop branch

Actions
Copy link
 #9

Updated by Ondřej Kopr over 3 years ago

  • Status changed from Needs feedback to Resolved
  • Assignee changed from Ondřej Kopr to Peter Štrunc
  • % Done changed from 90 to 100

Thank you @sourek for review and finding my mistake with type of password policy. I just checked you changes and it is OK.

Thank you.

Actions
Copy link
 #10

Updated by Peter Štrunc over 3 years ago

  • Status changed from Resolved to Closed
Actions
Copy link

Also available in: Atom PDF