Skip to content

Resolve "Allow to set a minimum password length via admin UI"

What does this MR do?

For #36776 (closed)

A demo can be viewed at https://drive.google.com/file/d/1nHTkLq-QZlijRCwcVq2lyXx7gX-2rP1N/view

  • Migration for adding a column to specify minimum password length
  • UI changes to allow admin to set minimum password length via Admin -> Settings -> General -> Sign up restrictions
  • Backend changes to support changing minimum password length value
  • Backend changes to have the change in minimum password length take effect without a GitLab restart
  • Tests
  • Documentation
  • Post-deploy migration to update the value of minimum_password_length column to [Devise.password_length.min, 8].max - ie, change the value to higher than 8, if the customer had overridden the Devise default using https://docs.gitlab.com/ee/security/password_length_limits.html

Screenshots

Minimum password length setting in admin:

Screenshot_2019-12-13_at_2.53.45_PM

On sign up page - mention of minimum password length:

Screenshot_2019-12-13_at_2.58.30_PM

Error messages:

On short password (Same as default Devise error message, only the limit differs):

Screenshot_2019-12-13_at_2.35.49_PM

On long password: (Same as default Devise error message):

Screenshot_2019-12-13_at_2.58.30_PM

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • Label as security and @ mention @gitlab-com/gl-security/appsec
  • The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • Security reports checked/validated by a reviewer from the AppSec team
Edited by Manoj M J

Merge request reports