Password policy

[François Marier]

For internal policy reasons, some people might need Mahara to enforce a password policy.

If we implement this feature, we should make sure that:

- it's optional
- it's disabled by default
- we include a warning saying that it could result in less secure passwords (ideally linking to research paper demonstrating this)

[Gregor Anželj (gregor-anzelj)]

Improve the password policy enforcement and configuration in Mahara. Have a pre-defined password policy of a minimum of 8 characters with type "alphanumeric mixed case + symbols". Also allow admins to set the password policy in Site Options > Security Settings. In all locations where password is set the password input should also include a password strength indicator.

[Kristina Hoeppner (kris-hoeppner)]

Patch is at https://reviews.mahara.org/#/c/8450

[Mahara Bot (dev-mahara)]

Reviewed: https://reviews.mahara.org/8450
Committed: https://git.mahara.org/mahara/mahara/commit/9c26c145f05529d95d01867f85ebfb5af0668d25
Submitter: Robert Lyon (<email address hidden>)
Branch: master

commit 9c26c145f05529d95d01867f85ebfb5af0668d25
Author: Gregor Anzelj <email address hidden>
Date: Wed Jan 17 21:02:50 2018 +0100

Bug 845263: Password policy

Improve the password policy enforcement and configuration in Mahara.
Have a pre-defined password policy of a minimum of 8 characters with
type "alphanumeric mixed case + symbols".

Also allow site administrators to set the desired password policy in
Site Options > Security Settings. In all locations where password
is set, the password input should also include a password strength
indicator.

Change-Id: I020af58a6cf1635fe295f5434783ce5b6f6daacb

[Kristina Hoeppner (kris-hoeppner)]

We decided to not make it optional.