Skip to content
Snippets Groups Projects

Feature/password complexity on backend

All threads resolved!

What does this MR do and why?

related issue #354966 (closed) Also related: #348484 (closed)

This is the backend MR of adding minimum password complexity to application_settings, so we can let administrators to customize the password complexity. The chars used in a password can be covered by 4 types, uppercase letters, lowercase letters, numbers and symbols, so the the max value of this column should be 4.

The default value of this column is set to 1 to not change the default behaviors of password validations, the password can be set to any chars if the password complexity is 1.

Screenshots or screen recordings

The following images that shows that final stage of this feature, but the frontend part is not included in this MR.

before after Validation from PW creation failed validation
before 1 2 Failed

How to set up and validate locally

bundle exec rspec ee/spec/features/users/signup_spec.rb

Database

Migrations

rails db:migrate:up VERSION=20220329092245

== 20220329092245 AddPasswordCharsRequirementToApplicationSettings: migrating =
-- add_column(:application_settings, :password_uppercase_required, :boolean, {:default=>false, :null=>false})
   -> 0.0042s
-- add_column(:application_settings, :password_lowercase_required, :boolean, {:default=>false, :null=>false})
   -> 0.0013s
-- add_column(:application_settings, :password_number_required, :boolean, {:default=>false, :null=>false})
   -> 0.0012s
-- add_column(:application_settings, :password_symbol_required, :boolean, {:default=>false, :null=>false})
   -> 0.0015s
== 20220329092245 AddPasswordCharsRequirementToApplicationSettings: migrated (0.0084s)


rails db:migrate:down VERSION=20220329092245

== 20220329092245 AddPasswordCharsRequirementToApplicationSettings: reverting =
-- remove_column(:application_settings, :password_symbol_required, :boolean, {:default=>false, :null=>false})
   -> 0.0032s
-- remove_column(:application_settings, :password_number_required, :boolean, {:default=>false, :null=>false})
   -> 0.0012s
-- remove_column(:application_settings, :password_lowercase_required, :boolean, {:default=>false, :null=>false})
   -> 0.0017s
-- remove_column(:application_settings, :password_uppercase_required, :boolean, {:default=>false, :null=>false})
   -> 0.0013s
== 20220329092245 AddPasswordCharsRequirementToApplicationSettings: reverted (0.0097s)

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by ARCHIVED - Martin Tan

Merge request reports

Loading
Loading

Activity

Filter activity
  • Approvals
  • Assignees & reviewers
  • Comments (from bots)
  • Comments (from users)
  • Commits & branches
  • Edits
  • Labels
  • Lock status
  • Mentions
  • Merge request status
  • Tracking
  • Added the sec-planningpending-followup label (to indicate that there is follow up action required on this MR from AppSec until a few ongoing discussions are resolved) based on the guidance in https://gitlab.com/gitlab-org/security/gitlab/-/issues/651.

    Edited by Rohit Shambhuni
  • mentioned in issue #358669 (closed)

  • added 1425 commits

    • f95d06b9...e3d05294 - 1419 commits from branch gitlab-org:master
    • 7fef0703 - Feat: add minimum password complexity to application settings
    • e0d70838 - Feat: add mininum password complexity checking for premium plan
    • c4d7f9b7 - Test: fix casese breaks pipeline
    • 29f943f2 - Feat: add password complexity requirements to settings
    • b3455d63 - Feat: update password complexity requirements
    • feaf292d - Refactor: improve the random password strength

    Compare with previous version

  • Thong Kuah
  • added 237 commits

    • feaf292d...892c2fc2 - 230 commits from branch gitlab-org:master
    • f0a1152e - Feat: add minimum password complexity to application settings
    • 5587c0a5 - Feat: add mininum password complexity checking for premium plan
    • 2de85869 - Test: fix casese breaks pipeline
    • cee0b36a - Feat: add password complexity requirements to settings
    • d6c05a6c - Feat: update password complexity requirements
    • 674b33eb - Refactor: improve the random password strength
    • b4d74f71 - Refactor: not touch the default random password if no password complexity policies

    Compare with previous version

  • added 1 commit

    • ed494502 - Refactor: not touch the default random password if no password complexity policies

    Compare with previous version

  • added 1 commit

    • 517aff16 - Fix: skip password complexity validation for user updating

    Compare with previous version

  • ARCHIVED - Martin Tan marked this merge request as ready

    marked this merge request as ready

  • Hannah Sutor changed milestone to %15.0

    changed milestone to %15.0

  • added 1261 commits

    • 517aff16...383c298e - 1252 commits from branch gitlab-org:master
    • e3506056 - Feat: add minimum password complexity to application settings
    • 183a3ad9 - Feat: add mininum password complexity checking for premium plan
    • 931905ca - Test: fix casese breaks pipeline
    • 4f0f1d8d - Feat: add password complexity requirements to settings
    • 4ab8c25e - Feat: update password complexity requirements
    • 9aa68297 - Refactor: improve the random password strength
    • e5145d1d - Refactor: not touch the default random password if no password complexity policies
    • 74c0661c - Fix: skip password complexity validation for user updating
    • 4904e0e6 - Feat: add password complexity validator

    Compare with previous version

  • added 1 commit

    • cbcd98f8 - Chore: dump structure.sql for pipeline

    Compare with previous version

  • mentioned in merge request !85763 (merged)

  • added 587 commits

    • cbcd98f8...6dbf2c01 - 576 commits from branch gitlab-org:master
    • 8bcb9301 - Feat: add minimum password complexity to application settings
    • fe53188a - Feat: add mininum password complexity checking for premium plan
    • 37ba9eb4 - Test: fix casese breaks pipeline
    • fc36cdda - Feat: add password complexity requirements to settings
    • 840ec907 - Feat: update password complexity requirements
    • d55288a1 - Refactor: improve the random password strength
    • 0f63e7fd - Refactor: not touch the default random password if no password complexity policies
    • 82d1d775 - Fix: skip password complexity validation for user updating
    • 777fd8e5 - Feat: add password complexity validator
    • 0af2de2d - Chore: dump structure.sql for pipeline
    • 903da824 - Fix: override user random_password method

    Compare with previous version

  • Imre Farkas requested review from @ifarkas

    requested review from @ifarkas

  • Imre Farkas
  • Imre Farkas removed review request for @ifarkas

    removed review request for @ifarkas

  • Thong Kuah
  • Rohit Shambhuni mentioned in issue #18691

    mentioned in issue #18691

  • added 91 commits

    • 903da824...4b885b06 - 78 commits from branch gitlab-org:master
    • c48399c5 - Feat: add minimum password complexity to application settings
    • eaf46b7d - Feat: add mininum password complexity checking for premium plan
    • 1d2341a6 - Test: fix casese breaks pipeline
    • 4aefdec0 - Feat: add password complexity requirements to settings
    • 5331d61b - Feat: update password complexity requirements
    • 36934257 - Refactor: improve the random password strength
    • c3b7fd11 - Refactor: not touch the default random password if no password complexity policies
    • 8961c645 - Fix: skip password complexity validation for user updating
    • 73854c02 - Feat: add password complexity validator
    • a0c73478 - Chore: dump structure.sql for pipeline
    • 23ae9fbe - Fix: override user random_password method
    • 56f08fd9 - Fix: add specs for password validator
    • def559b9 - Chore: regenerate structure.sql

    Compare with previous version

  • added 2 commits

    • 0628e63c - Chore: regenerate structure.sql
    • 3c200b44 - Test: add password specs for user updating

    Compare with previous version

  • added 1 commit

    • 320f19ac - Fix: add specs for password validator

    Compare with previous version

  • ARCHIVED - Martin Tan changed the description

    changed the description

  • requested review from @alexives

  • Sincheol (David) Kim approved this merge request

    approved this merge request

  • Alex Ives requested review from @tigerwnz and removed review request for @alexives

    requested review from @tigerwnz and removed review request for @alexives

  • Tiger Watson approved this merge request

    approved this merge request

  • added databaseapproved label and removed databasereviewed label

  • Tiger Watson removed review request for @tigerwnz

    removed review request for @tigerwnz

  • Nick Malcolm mentioned in merge request !86310 (merged)

    mentioned in merge request !86310 (merged)

  • mentioned in issue #348484 (closed)

  • Hi @rshambhuni, Looks like we do not have new comments for now, how is the review going? :smile_cat:

  • Rohit Shambhuni approved this merge request

    approved this merge request

  • Rohit Shambhuni removed review request for @rshambhuni

    removed review request for @rshambhuni

  • ARCHIVED - Martin Tan resolved all threads

    resolved all threads

  • Thong Kuah requested review from @ifarkas

    requested review from @ifarkas

  • added 3025 commits

    • 320f19ac...2c6b6917 - 3010 commits from branch gitlab-org:master
    • 7cb902ba - Feat: add minimum password complexity to application settings
    • a20d865a - Feat: add mininum password complexity checking for premium plan
    • 8b04c451 - Test: fix casese breaks pipeline
    • 2c351ebb - Feat: add password complexity requirements to settings
    • 8536cfae - Feat: update password complexity requirements
    • a1aa5c7c - Refactor: improve the random password strength
    • fa2e0a01 - Refactor: not touch the default random password if no password complexity policies
    • ba38c130 - Fix: skip password complexity validation for user updating
    • 0fdfda51 - Feat: add password complexity validator
    • 94a19fb0 - Chore: dump structure.sql for pipeline
    • aa8fa1ba - Fix: override user random_password method
    • 120522fd - Fix: add specs for password validator
    • ecc3ea6a - Chore: regenerate structure.sql
    • 8d0a2da5 - Test: add password specs for user updating
    • a03d003d - Fix: add specs for password validator

    Compare with previous version

  • Rohit Shambhuni unapproved this merge request

    unapproved this merge request

  • Rohit Shambhuni approved this merge request

    approved this merge request

  • 🤖 GitLab Bot 🤖 resolved all threads

    resolved all threads

  • Imre Farkas removed review request for @ifarkas

    removed review request for @ifarkas

  • added 213 commits

    • a03d003d...4b6e735a - 197 commits from branch gitlab-org:master
    • 383706f2 - Feat: add minimum password complexity to application settings
    • cec73604 - Feat: add mininum password complexity checking for premium plan
    • 9e24dd42 - Test: fix casese breaks pipeline
    • 9959c281 - Feat: add password complexity requirements to settings
    • abeffd7f - Feat: update password complexity requirements
    • 13765318 - Refactor: improve the random password strength
    • ad725bc0 - Refactor: not touch the default random password if no password complexity policies
    • cc90ae2d - Fix: skip password complexity validation for user updating
    • 26966a6a - Feat: add password complexity validator
    • 60a1809f - Chore: dump structure.sql for pipeline
    • 452bde9c - Fix: override user random_password method
    • c5fad8d0 - Fix: add specs for password validator
    • eb33b367 - Chore: regenerate structure.sql
    • 83f50474 - Test: add password specs for user updating
    • 2bd09bbd - Fix: add specs for password validator
    • 41778434 - Test: resolve MR comments on specs

    Compare with previous version

  • added 263 commits

    • 41778434...d3cb7805 - 245 commits from branch gitlab-org:master
    • 74298fb4 - Feat: add minimum password complexity to application settings
    • 32b31a01 - Feat: add mininum password complexity checking for premium plan
    • b149cca7 - Test: fix casese breaks pipeline
    • 7addd79b - Feat: add password complexity requirements to settings
    • be7cd8e3 - Feat: update password complexity requirements
    • e1c33cc0 - Refactor: improve the random password strength
    • 37d21e33 - Refactor: not touch the default random password if no password complexity policies
    • a5d98a17 - Fix: skip password complexity validation for user updating
    • d7841a18 - Feat: add password complexity validator
    • 0757efb5 - Chore: dump structure.sql for pipeline
    • a220b8b5 - Fix: override user random_password method
    • c1f15b19 - Fix: add specs for password validator
    • 6f6ec154 - Chore: regenerate structure.sql
    • 1a46bcf8 - Test: add password specs for user updating
    • 01b40bb7 - Fix: add specs for password validator
    • c7e8dde7 - Test: resolve MR comments on specs
    • d1f8f421 - Fix: fix failed rubocop job
    • 8e19aafa - Test: use stub setting in specs

    Compare with previous version

  • added 42 commits

    • 8e19aafa...ad0d820d - 24 commits from branch gitlab-org:master
    • 114f3e55 - Feat: add minimum password complexity to application settings
    • 111dd9ec - Feat: add mininum password complexity checking for premium plan
    • 17e8f1be - Test: fix casese breaks pipeline
    • b6b3d8f6 - Feat: add password complexity requirements to settings
    • 4f13e886 - Feat: update password complexity requirements
    • 7cd964ba - Refactor: improve the random password strength
    • 2a5148ab - Refactor: not touch the default random password if no password complexity policies
    • ec27a5db - Fix: skip password complexity validation for user updating
    • 3c580ad7 - Feat: add password complexity validator
    • 7fc554d7 - Chore: dump structure.sql for pipeline
    • c2b22d2a - Fix: override user random_password method
    • efbf1ee7 - Fix: add specs for password validator
    • 8e83e475 - Chore: regenerate structure.sql
    • 0f75bc1b - Test: add password specs for user updating
    • cce50773 - Fix: add specs for password validator
    • 2f5b4035 - Test: resolve MR comments on specs
    • 7b53772d - Fix: fix failed rubocop job
    • d39f7d52 - Test: use stub setting in specs

    Compare with previous version

  • Nick Malcolm mentioned in design management/design #23610 (closed)[alert.png]

    mentioned in design management/design #23610 (closed)[alert.png]

  • added 1 commit

    • e6e9af02 - Test: resolve MR comments for specs

    Compare with previous version

  • Imre Farkas requested review from @ifarkas

    requested review from @ifarkas

  • added 291 commits

    • e6e9af02...9534dfb4 - 272 commits from branch gitlab-org:master
    • da5a33cf - Feat: add minimum password complexity to application settings
    • 8e1f53e7 - Feat: add mininum password complexity checking for premium plan
    • 6492a3b4 - Test: fix casese breaks pipeline
    • fa24b850 - Feat: add password complexity requirements to settings
    • 62b0797e - Feat: update password complexity requirements
    • db86cbbe - Refactor: improve the random password strength
    • 2a8f3e30 - Refactor: not touch the default random password if no password complexity policies
    • 340277e8 - Fix: skip password complexity validation for user updating
    • 63f89448 - Feat: add password complexity validator
    • 34b6502e - Chore: dump structure.sql for pipeline
    • ad92a482 - Fix: override user random_password method
    • 66babf66 - Fix: add specs for password validator
    • 4c680e84 - Chore: regenerate structure.sql
    • c695a0dc - Test: add password specs for user updating
    • 85f6cb8d - Fix: add specs for password validator
    • 4139b31e - Test: resolve MR comments on specs
    • af8fdf8c - Fix: fix failed rubocop job
    • a31240f0 - Test: use stub setting in specs
    • c1c55b40 - Test: resolve MR comments for specs

    Compare with previous version

  • added 185 commits

    • c1c55b40...bc2fe3f1 - 180 commits from branch gitlab-org:master
    • f8550f62 - Feat: add minimum password complexity to application settings
    • cdf2dbc8 - Feat: add mininum password complexity checking for premium plan
    • 9612e18e - Feat: add password complexity requirements to settings
    • e4d874d7 - Feat: add password complexity validator
    • 4b3002d1 - Test: resolve MR comments on specs

    Compare with previous version

  • Imre Farkas removed review request for @ifarkas

    removed review request for @ifarkas

  • added 174 commits

    • 4b3002d1...d13bb990 - 168 commits from branch gitlab-org:master
    • 38eb4aca - Feat: add minimum password complexity to application settings
    • a2fa71cd - Feat: add mininum password complexity checking for premium plan
    • d0a507a9 - Feat: add password complexity requirements to settings
    • 0da538e6 - Feat: add password complexity validator
    • 9aef7016 - Test: resolve MR comments on specs
    • 885f3e76 - Test: resolve MR comments for specs

    Compare with previous version

  • mentioned in issue #23610 (closed)

  • Kyle Wiebers requested review from @rshambhuni

    requested review from @rshambhuni

  • Imre Farkas approved this merge request

    approved this merge request

  • Imre Farkas requested review from @tkuah

    requested review from @tkuah

  • Rohit Shambhuni unapproved this merge request

    unapproved this merge request

  • Rohit Shambhuni approved this merge request

    approved this merge request

  • Rohit Shambhuni removed review request for @rshambhuni

    removed review request for @rshambhuni

  • Just one thing @mtan-gitlab ! See above

  • Thong Kuah removed review request for @tkuah

    removed review request for @tkuah

  • added 262 commits

    • 885f3e76...76a32d3a - 255 commits from branch gitlab-org:master
    • 74dbe717 - Feat: add minimum password complexity to application settings
    • 7fbe208c - Feat: add mininum password complexity checking for premium plan
    • def31f17 - Feat: add password complexity requirements to settings
    • b294df42 - Feat: add password complexity validator
    • 68a99760 - Test: resolve MR comments on specs
    • bf800e5c - Test: resolve MR comments for specs
    • 0e15f812 - Fix: update migration file to version 2.0

    Compare with previous version

  • Thong Kuah approved this merge request

    approved this merge request

  • Suggested Reviewers (beta)

    The individuals below may be good candidates to participate in the review based on various factors.

    You can use slash commands in comments to quickly assign /assign_reviewer @user1.

    Suggested Reviewers
    @NikolayS, @adriel, @kmann, @rymai, @npost

    If you do not believe these suggestions are useful, please apply the label Bad Suggested Reviewer. You can also provide feedback for this feature on this issue: https://gitlab.com/gitlab-org/gitlab/-/issues/357923.

    Automatically generated by Suggested Reviewers Bot - an experimental ML-based recommendation engine created by ~"group::applied ml".

  • 3 Warnings
    :warning: This MR has a Changelog commit with the EE: true trailer, but there are database changes which requires the Changelog commit to not have the EE: true trailer. Consider removing the EE: true trailer from your commits.
    :warning: def31f17: The commit body should not contain more than 72 characters per line. For more information, take a look at our Commit message guidelines.
    :warning: 74dbe717: Commits that change 30 or more lines across at least 3 files should describe these changes in the commit body. For more information, take a look at our Commit message guidelines.

    If needed, you can retry the :repeat: danger-review job that generated this comment.

    Notification to the Data Team about changes to files with possible impact on Data Warehouse, add label Data Warehouse::Impact Check.

    The following files require a review:

    • db/structure.sql

    Reviewer roulette

    Changes that require review have been detected!

    Please refer to the table below for assigning reviewers and maintainers suggested by Danger in the specified category:

    Category Reviewer Maintainer
    backend Dominic Bauer (@bauerdominic) (UTC+2) Andy Soiron (@Andysoiron) (UTC+0)
    database Diogo Frazão (@dfrazao-gitlab) (UTC+0) Adam Hegyi (@ahegyi) (UTC+2)
    ~migration No reviewer available No maintainer available

    To spread load more evenly across eligible reviewers, Danger has picked a candidate for each review slot, based on their timezone. Feel free to override these selections if you think someone else would be better-suited or use the GitLab Review Workload Dashboard to find other available reviewers.

    To read more on how to use the reviewer roulette, please take a look at the Engineering workflow and code review guidelines. Please consider assigning a reviewer or maintainer who is a domain expert in the area of the merge request.

    Once you've decided who will review this merge request, assign them as a reviewer! Danger does not automatically notify them for you.

    Generated by :no_entry_sign: Danger

  • Evan Read changed milestone to %15.1

    changed milestone to %15.1

  • Rohit Shambhuni unapproved this merge request

    unapproved this merge request

  • Rohit Shambhuni approved this merge request

    approved this merge request

  • 🤖 GitLab Bot 🤖 resolved all threads

    resolved all threads

  • Thong Kuah enabled an automatic merge when the pipeline for 66c39b8a succeeds

    enabled an automatic merge when the pipeline for 66c39b8a succeeds

  • Allure report

    allure-report-publisher generated test report!

    review-qa-blocking: :exclamation: test report for 0e15f812

    expand test summary
    +-------------------------------------------------------------------+
    |                          suites summary                           |
    +----------------------+--------+--------+---------+-------+--------+
    |                      | passed | failed | skipped | flaky | result |
    +----------------------+--------+--------+---------+-------+--------+
    | Create               | 23     | 0      | 2       | 23    | ❗     |
    | Manage               | 36     | 0      | 2       | 38    | ❗     |
    | Plan                 | 41     | 0      | 1       | 41    | ❗     |
    | Verify               | 12     | 0      | 1       | 12    | ❗     |
    | Package              | 0      | 0      | 1       | 0     | ➖     |
    | Version sanity check | 0      | 0      | 1       | 0     | ➖     |
    | Protect              | 2      | 0      | 0       | 2     | ❗     |
    | Configure            | 0      | 0      | 1       | 0     | ➖     |
    +----------------------+--------+--------+---------+-------+--------+
    | Total                | 114    | 0      | 9       | 116   | ❗     |
    +----------------------+--------+--------+---------+-------+--------+
  • merged

  • mentioned in commit c39f1f9f

  • Thong Kuah mentioned in commit f207dffe

    mentioned in commit f207dffe

  • @mtan-gitlab, how was your code review experience with this merge request? Please tell us how we can continue to iterate and improve:

    1. Leave a :thumbsup: or a :thumbsdown: on this comment to describe your experience.
    2. Create a new comment starting with @gitlab-bot feedback below, and leave any additional feedback you have for us in the comment.

    Have five minutes? Take our survey to give us even more feedback on how GitLab can improve the contributor experience.

    Thanks for your help! :heart:

  • Lin Jen-Shin resolved all threads

    resolved all threads

  • added workflowstaging label and removed workflowcanary label

  • Nick Malcolm mentioned in epic &8139

    mentioned in epic &8139

  • Krasimir Angelov
  • mentioned in merge request !88621 (closed)

  • Krasimir Angelov resolved all threads

    resolved all threads

  • Kun Qian mentioned in merge request !85765 (merged)

    mentioned in merge request !85765 (merged)

  • Kun Qian mentioned in merge request !94756 (closed)

    mentioned in merge request !94756 (closed)

  • Please register or sign in to reply
    Loading