[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: [ldapext] Fwd: I-D Action:draft-zeilenga-ldap-passwords-00.txt
On Mon, 2008-03-31 at 17:23 -0700, Howard Chu wrote:
> simo wrote:
> >>> 4)
> >>>
> >>> The number of constraints seem quite limited, are you open to
> >>> suggestion
> >>> for more constraint types that are currently commonly used in various
> >>> server implementations ?
> >> Yes.
> >
> > Thanks,
> > there are some encoding (utf-8) dependent constraints that are widely
> > used like:
> >
> > - minimum length in characters
> > - maximum number of repetitions of the same character in a password
> > - minimum number of alphabetic characters
> > - minimum number of lower case characters
> > - minimum number of upper case characters
> > - minimum number of digits
> > - minimum number of special characters (usually ASCII characters that
> > represent symbols, but may be extended to other symbols in the UTF-8
> > space)
> > - minimum number of ASCII characters (as opposed to other utf-8
> > characters)
> > - complexity checks, like the checks performed by the cracklib library
> > to make sure the user name (or other user data) is not used as part of
> > the password itself, or the password is not too similar to a dictionary
> > word (locale dependent sometimes).
>
> I recall when draft-behera was being discussed that folks wanted more
> constraints, but nobody suggested what those might be. This is a pretty good
> list. As for complexity checks, that may still be more difficult to
> standardize. In OpenLDAP we punt that to a user-written checking module.
>
> I don't really see a good way to fully spec this here, unless you want to
> define an attribute to carry ABNF rules that a password must conform to. Or,
> we could define a list of "dictionaries" that must be checked, where a
> "dictionary" is a specified version number of a well-known word list, library
> (like cracklib) or other external mechanism.
I would consider this option features, implementation dependent.
Simo.
--
Simo Sorce
Samba Team GPL Compliance Officer <simo@samba.org>
Senior Software Engineer at Red Hat Inc. <ssorce@redhat.com>
_______________________________________________
Ldapext mailing list
Ldapext@ietf.org
https://www.ietf.org/mailman/listinfo/ldapext