Changes between Version 4 and Version 5 of campuswifiandeduroam2023Agenda/pwdc

Timestamp:

Jul 22, 2024, 6:10:08 PM (4 months ago)

Author:

tuwan

Comment:

--

campuswifiandeduroam2023Agenda/pwdc

@@ -196 +196 @@
 $who_change_password = "user";
 }}}
+
+'''Search parameters'''
+
+{{{$ldap_base = "dc=learn,dc=ac,dc=lk";}}}
+
+The filter can be set in $ldap_filter
+
+{{{
+$ldap_filter = "(&(objectClass=person)(uid={login}))";
+}}}
+
+'''Extensions'''
+
+You can use LDAP password modify extended operation wit
+
+{{{
+$ldap_use_exop_passwd = true;
+}}}
+
+You can also enable LDAP password policy control with
+
+{{{
+$ldap_use_ppolicy_control = true;
+}}}
+
+Force unlock: will unlock a locked account when password is changed
+
+{{{
+$ad_options['force_unlock'] = true;
+}}}
+
+Force user to change password at next login:
+{{{
+$ad_options['force_pwd_change'] = true;
+}}}
+
+Allow user to change password if password is expired (this will force the password to be changed as manager):
+
+{{{
+$ad_options['change_expired_password'] = true;
+}}}
+
+//'''Password Policy'''//
+
+You can use these schemes to hash the password before sending it to LDAP directory:
+- SHA, SHA256, SHA384, SHA512
+- SSHA, SSHA256, SSHA384, SSHA512
+- MD5
+- SMD5
+- CRYPT
+- ARGON2
+- clear
+- auto
+
+Set one of them in $hash
+
+{{{
+$hash = "clear";
+}}}
+
+You can configure the crypt salt prefix to choose the algorithm
+Optional:
+[http://php.net/manual/en/function.crypt.php crypt document]
+
+{{{
+$hash_options['crypt_salt_prefix'] = "$6$";
+}}}
+
+'''Size'''
+
+Set minimal and maximal length in $pwd_min_length and $pwd_max_length:
+
+{{{
+$pwd_min_length = 4;
+$pwd_max_length = 8;
+}}}
+
+//{{{Set 0 in $pwd_max_length to disable maximal length checking.}}}//
+
+'''Characters'''
+You can set the minimal number of lower, upper, digit and special characters:
+
+{{{
+$pwd_min_lower = 3;
+$pwd_min_upper = 1;
+$pwd_min_digit = 1;
+$pwd_min_special = 1;
+}}}
+
+Special characters are defined with a regular expression, by default:
+{{{
+$pwd_special_chars = "^a-zA-Z0-9";
+}}}
+
+This means special characters are all characters except alphabetical letters and digits.
+
+You can check that these special characters are not at beginning or end of the password:
+
+{{{
+$pwd_no_special_at_ends = true;
+}}}
+
+You can also disallow characters from being in password, with $pwd_forbidden_chars:
+
+{{{
+$pwd_forbidden_chars = "@%";
+}}}
+
+//This means that @ and % could not be present in a password.//
+
+You can define how many different class of characters (lower, upper, digit, special) are needed in the password:
+{{{
+$pwd_complexity = 2;
+}}}
+
+'''Pwned Passwords'''
+
+Allows to check if the password was already compromised
+[https://haveibeenpwned.com/]
+{{{
+$use_pwnedpasswords = true;
+}}}
+
+'''Re use'''
+You can prevent a user from using his old password as a new password if this check is not done by the directory:
+{{{
+$pwd_no_reuse = true;
+}}}
+
+You may also want to check for partial password reuses, ensuring the new password includes at least N distinct new characters:
+
+{{{
+$pwd_diff_last_min_chars = 3;
+}}}
+
+'''Forbidden words'''
+
+Give a list of forbidden words that the password should not contain
+{{{
+$pwd_forbidden_words = array("azerty", "qwerty", "password");
+}}}
+
+'''Forbidden LDAP fields'''
+
+Give a list of LDAP fields which values should not be present in the password:
+
+{{{
+$pwd_forbidden_ldap_fields = array('cn', 'givenName', 'sn', 'mail');
+}}}
+