Project

Profile

Help

Story #2366

As a user, my password can be expired

Added by ttereshc almost 4 years ago. Updated over 1 year ago.

Status:
CLOSED - WONTFIX
Priority:
Normal
Assignee:
-
Category:
-
Sprint/Milestone:
-
Start date:
Due date:
% Done:

0%

Estimated time:
Platform Release:
Groomed:
No
Sprint Candidate:
No
Tags:
Pulp 2
Sprint:
Quarter:

Description

Make the user password expirable in Pulp and create an option in config for the expiration period.
Upon password expiration JWT tokens should be invalidated as well.


Related issues

Related to Pulp - Task #2090: Create a plan for user/auth in 3.0CLOSED - CURRENTRELEASE

<a title="Actions" class="icon-only icon-actions js-contextmenu" href="#">Actions</a>

History

#1 Updated by ttereshc almost 4 years ago

  • Description updated (diff)

#2 Updated by ttereshc almost 4 years ago

  • Related to Task #2090: Create a plan for user/auth in 3.0 added

#3 Updated by bmbouter almost 4 years ago

I think of this story as capturing the use case to change a password. Changing a password causes all existing JWT tokens to expire which is a side-effect of the changing the password. I think the config portion should be removed from this story because that is part of #2367

#4 Updated by ttereshc almost 4 years ago

I thought that password change will be captured by the work on User model but now I agree that it makes sense to track it separately.
I also imagined that password expiration time and JWT expiration time can be different. It is also would be more clear for users what setting they set, in case they use basic auth on every request (password expiration) or when they use some kind of external auth (only JWT expiration makes sense). I suggest not to remove but to move config portion from this story to #2367, so there will be two different config options to implement in it.
What do you think?

#5 Updated by bmbouter almost 4 years ago

I imagined only 1 config and it would be the valid length a JWT token is accepted for. I did not think we would require users to change their passwords. When I read the title about a password "expiring" I thought you meant a JWT expiring. I don't think passwords should be required to be changed.

#6 Updated by ttereshc almost 4 years ago

  • Status changed from NEW to CLOSED - WONTFIX

#7 Updated by bmbouter over 1 year ago

  • Tags Pulp 2 added

Please register to edit this issue

Also available in: Atom PDF