Issues with password validation configurations

[janakamarasena]

Describe the issue:
The are two places the password validation can be configured and it is unclear which takes precedence. Password validation can be configured through the configuration available in the console called Password Validation[1] also a password validation regex can be configured through the user-mgt.xml(via deployment.toml) config for the PRIMARY userstore and also when onboarding secondary userstores. It is unclear to which user stores(or globally) the Password Validation configuration in the console applies to.

I could notice while the user-mgt password pattern had a minimum char length as 5 (<Property name="PasswordJavaRegEx">^[\S]{5,30}$</Property>) the UI had enforced a minimum length of 8.

It should be cleared out what configuration honoured. And if there are unused configurations then references to them should be removed clearing any confusions.

[1] - https://is.docs.wso2.com/en/next/guides/account-configurations/login-security/password-validation/

[Thumimku]

Hi @janakamarasena ,

With this feature, we introduced organisation wide password validation mechanism where the admin can configure password validation rules which is common for all userstores.

Regarding the user store wise password validation feature, the xml files and logics were there to preserve backward compatibility for any migrated users. Hence we can't remove the configuration. But we are not promoting for new users. In our IS 7 doc space we don't mention about userstore level password validation.

Regarding the precedence, when the password input validation listener is enabled(current approach) user store level password validation won't work.

Hence, this is not a bug rather than a issue related to documentation for migration.

For migrated users user store level password validation can be provided by following configuration based on my quick research (not tested the flow in console),

Disable input validation listener.

[event.default_listener.validation]
enable = "false"

Enable password policy handler.

[identity_mgt.password_policy.password_policy_validation_handler]
enable=true

[DMHP]

• 1 to add this to migration documents and proceed.

[Thumimku]

I am closing this issue cause the migration issue tracked with #19068
CC: @DMHP @janakamarasena