Skip to content

Resolve "Allow to set a minimum password length via admin UI"

What does this MR do?

For #36776 (closed)

A demo can be viewed at

  • Migration for adding a column to specify minimum password length
  • UI changes to allow admin to set minimum password length via Admin -> Settings -> General -> Sign up restrictions
  • Backend changes to support changing minimum password length value
  • Backend changes to have the change in minimum password length take effect without a GitLab restart
  • Tests
  • Documentation
  • Post-deploy migration to update the value of minimum_password_length column to [Devise.password_length.min, 8].max - ie, change the value to higher than 8, if the customer had overridden the Devise default using


Minimum password length setting in admin:


On sign up page - mention of minimum password length:


Error messages:

On short password (Same as default Devise error message, only the limit differs):


On long password: (Same as default Devise error message):


Does this MR meet the acceptance criteria?


Availability and Testing


If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • Label as security and @ mention @gitlab-com/gl-security/appsec
  • The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • Security reports checked/validated by a reviewer from the AppSec team
Edited by Manoj M J

Merge request reports