Password policy : Password can have part of user name in different cases

DHS009 · July 18, 2022, 8:04am

Hi,

I have added the password policy but after that I tried to authenticate the policy. It’s not working well in some conditions.

As per the policy => Not username: The password cannot be the same as the username.
https://github.com/keycloak/keycloak-documentation/blob/main/server_admin/topics/authentication/password-policies.adoc

Password policy states it shouldn’t contain a part of user name. However, it allows user name in different case.

for example : if the tenant user is → roger123@yopmail.com

Then we cannot set password with a part of user name → roger

But if we change the case of it, it allows us to set the password → Roger, ROGER

Is it a bug or I misunderstood the policy?

Please share your views on it.

Thankyou

xgp · July 20, 2022, 2:51pm

The policy checks for a case-sensitive match:

github.com

keycloak/keycloak/blob/main/server-spi-private/src/main/java/org/keycloak/policy/NotUsernamePasswordPolicyProvider.java

/*
 * Copyright 2016 Red Hat, Inc. and/or its affiliates
 * and other contributors as indicated by the @author tags.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package org.keycloak.policy;

import org.keycloak.models.KeycloakContext;

This file has been truncated. show original

If you want it work differently, you can implement your own provider.

Topic		Replies	Views
Set Password Polices Getting advice authentication	2	294	April 11, 2024
"Not Recently Used" password policy not working Configuring the server admin-console , user-federation , ldap	5	2216	May 23, 2023
User with no password expiry (or) password policy specific to user Getting advice	1	1345	March 2, 2020
Authenticate based on a 'domain\user' username	0	409	March 3, 2022
Conditional identifier when logging in Getting advice authentication , ldap	0	137	March 13, 2024

Password policy : Password can have part of user name in different cases

Related Topics