Project

Profile

Help

Story #2366

closed

As a user, my password can be expired

Added by ttereshc over 7 years ago. Updated almost 5 years ago.

Status:
CLOSED - WONTFIX
Priority:
Normal
Assignee:
-
Category:
-
Sprint/Milestone:
-
Start date:
Due date:
% Done:

0%

Estimated time:
Platform Release:
Groomed:
No
Sprint Candidate:
No
Tags:
Pulp 2
Sprint:
Quarter:

Description

Make the user password expirable in Pulp and create an option in config for the expiration period.
Upon password expiration JWT tokens should be invalidated as well.


Related issues

Related to Pulp - Task #2090: Create a plan for user/auth in 3.0CLOSED - CURRENTRELEASEttereshc

Actions
Actions #1

Updated by ttereshc over 7 years ago

  • Description updated (diff)
Actions #2

Updated by ttereshc over 7 years ago

  • Related to Task #2090: Create a plan for user/auth in 3.0 added
Actions #3

Updated by bmbouter over 7 years ago

I think of this story as capturing the use case to change a password. Changing a password causes all existing JWT tokens to expire which is a side-effect of the changing the password. I think the config portion should be removed from this story because that is part of #2367

Actions #4

Updated by ttereshc over 7 years ago

I thought that password change will be captured by the work on User model but now I agree that it makes sense to track it separately.
I also imagined that password expiration time and JWT expiration time can be different. It is also would be more clear for users what setting they set, in case they use basic auth on every request (password expiration) or when they use some kind of external auth (only JWT expiration makes sense). I suggest not to remove but to move config portion from this story to #2367, so there will be two different config options to implement in it.
What do you think?

Actions #5

Updated by bmbouter over 7 years ago

I imagined only 1 config and it would be the valid length a JWT token is accepted for. I did not think we would require users to change their passwords. When I read the title about a password "expiring" I thought you meant a JWT expiring. I don't think passwords should be required to be changed.

Actions #6

Updated by ttereshc over 7 years ago

  • Status changed from NEW to CLOSED - WONTFIX
Actions #7

Updated by bmbouter almost 5 years ago

  • Tags Pulp 2 added

Also available in: Atom PDF