Feature #24655
closedFeature #47765: mgr/dashboard: security improvements
mgr/dashboard: Enforce password change upon first login
20%
Description
For local user accounts, it should be possible to enforce a password change upon the first login to the dashboard. This could be determined by either having a flag associated with the user (e.g. "reset_password"), or by checking a "last login" timestamp (which would also make it possible to enforce a password change after a certain period of time). With regards to issue #24654 it might actually be feasible to have the "reset_password" flag as well.
Updated by Lenz Grimmer almost 6 years ago
- Assignee deleted (
Lenz Grimmer) - Tags set to dashboard
Updated by Elzbieta Dziomdziora over 5 years ago
- Assignee set to Elzbieta Dziomdziora
Updated by Elzbieta Dziomdziora almost 5 years ago
- Status changed from New to Fix Under Review
- % Done changed from 0 to 100
Updated by Elzbieta Dziomdziora almost 5 years ago
- % Done changed from 100 to 80
Updated by Tiago Melo almost 5 years ago
I think we need to improve a few aspects of this process.
Here are the steps I would recommend:
1. The admin should be able to enable a field requiring the users to change his password next time he tries to log in.
This can be done during creation or update of the user.
2. When a user tries to login and the "reset password" flag is enabled, the login should fail.
The backend should respond with a special token that will be used to reset the password.
This token should have a TTL and be stored.
Maybe we could use the same field as the SSO, and send the redirect URL.
2.1 If a user tries to login again and there is already a reset token that has expired, the user should be disabled.
3. The user should be redirected to page, similar to login, where it does not need to be logged in.
The URL of this page should contain the token sent by the backend.
p.e.: localhost/#/reset/<TOKEN>
4. For extra security we should ask the user to type twice the new password.
After the user types the passwords and press "submit", we should attach the token to the request.
6. The backend will verify all the data and then change the user password.
If the TTL has expired, we should disabled the user account and show a message telling the user to contact an admin.
Updated by Lenz Grimmer almost 5 years ago
- Translation missing: en.field_tag_list set to security
- Target version set to v15.0.0
Updated by Lenz Grimmer almost 5 years ago
- Related to Feature #40248: mgr/dashboard: As a user, I want to change my password added
Updated by Lenz Grimmer almost 5 years ago
- Related to Feature #25229: mgr/dashboard: Provide user enable/disable capability added
Updated by Lenz Grimmer almost 5 years ago
- Related to Feature #25232: mgr/dashboard: Support minimum password complexity rules added
Updated by Lenz Grimmer almost 5 years ago
- Related to Feature #40329: mgr/dashboard: It should be possible to set an expiration date for the user password added
Updated by Lenz Grimmer almost 5 years ago
- Related to Feature #39999: mgr/dashboard: Prevent brute-force/dictionary attacks against existing local user accounts added
Updated by Elzbieta Dziomdziora almost 5 years ago
My plan for this ticket is to create a checkbox, where admin can decide whether the user has to or doesnt has to change the password. The value is set in access_control file under name forceCheckPwd, and it is going to be checked during login phase.
According to the ticket 40329, it will have expiration date, which will be checked when the forceCheckPwd is true.
When the time for changing password will expire,there will be massage to contact the admin.
When it will be possible to change password then the user will be navigate to the changePassword page.
Updated by Lenz Grimmer over 4 years ago
- Pull request ID changed from 28405 to 29529
Updated by Tatjana Dehler over 4 years ago
- Status changed from Fix Under Review to In Progress
- Assignee changed from Elzbieta Dziomdziora to Tatjana Dehler
- % Done changed from 80 to 20
- Pull request ID deleted (
29529)
Updated by Tatjana Dehler over 4 years ago
- Assignee changed from Tatjana Dehler to Volker Theile
Updated by Volker Theile over 4 years ago
- Priority changed from Normal to Urgent
Updated by Lenz Grimmer about 4 years ago
- Status changed from In Progress to Resolved
Updated by Ernesto Puerta almost 4 years ago
- Copied to Backport #46837: nautilus: mgr/dashboard: user management improvements (password change, password complexity, ...) added
Updated by Ernesto Puerta almost 4 years ago
- Status changed from Resolved to Pending Backport
- Backport set to nautilus
Updated by Ernesto Puerta over 3 years ago
- Status changed from Pending Backport to Closed
- Backport deleted (
nautilus)
For clean/safe backport it requires more than 11 additionall PRs
Closing.
Updated by Ernesto Puerta about 3 years ago
- Project changed from mgr to Dashboard
- Category changed from 150 to Component - Users & Roles