GitLab Next

What does this MR do?

For #36776 (closed)

A demo can be viewed at https://drive.google.com/file/d/1nHTkLq-QZlijRCwcVq2lyXx7gX-2rP1N/view

• Migration for adding a column to specify minimum password length
• UI changes to allow admin to set minimum password length via Admin -> Settings -> General -> Sign up restrictions
• Backend changes to support changing minimum password length value
• Backend changes to have the change in minimum password length take effect without a GitLab restart
• Tests
• Documentation
• Post-deploy migration to update the value of minimum_password_length column to [Devise.password_length.min, 8].max - ie, change the value to higher than 8, if the customer had overridden the Devise default using https://docs.gitlab.com/ee/security/password_length_limits.html

Screenshots

Minimum password length setting in admin:

On sign up page - mention of minimum password length:

Error messages:

On short password (Same as default Devise error message, only the limit differs):

On long password: (Same as default Devise error message):

Does this MR meet the acceptance criteria?

Conformity

• Changelog entry
• Documentation (if required)
• Code review guidelines
• Merge request performance guidelines
• Style guides
• Database guides
• Separation of EE specific content

Availability and Testing

• Review and add/update tests for this feature/bug. Consider all test levels. See the Test Planning Process.
• Tested in all supported browsers

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

• Label as security and @ mention @gitlab-com/gl-security/appsec
• The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
• Security reports checked/validated by a reviewer from the AppSec team