KC-1423: fix validation for passwords and passphrase in record creation and updation - #2330
KC-1423: fix validation for passwords and passphrase in record creation and updation#2330sshrushanth-ks wants to merge 7 commits into
Conversation
#2325) * KC-1408: Treat first-time share invitations as success in Service Mode (#2303) * Treat first-time share invitations as success in Service Mode * Use ShareInviteSentError so NSF invite success does not mask real share failures * Fix test imports for deleted pam_debug modules Remove imports and tests for PAMDebugACLCommand and PAMDebugLinkCommand, which were deleted in commit 2f1447a. Update test file to only include tests for modules that still exist.
…on and updation (#2314) * fix validation for passwords and passphrase in record creation and updation * Fix generated password policy validation after review - Track generated key-pair passphrases - Centralize v3 add/edit policy validation - Preserve random-password diagnostics - Keep manual passwords exempt from generated-password policy - Add regression coverage across record and NSF commands * Validate generated passwords at generation site instead of post-hoc via instance flags. This fixes two issues: 1. v3 add/edit --generate now validates (was silently bypassed) 2. No cross-field contamination in multi-field records Manual passwords remain unvalidated (handled by BreachWatch). * updated failing test
craiglurey
left a comment
craiglurey
left a comment
There was a problem hiding this comment.
I don’t agree with this. The whole point of enterprise enforcements is to ensure that users can’t type or generate a weak password. The functionality of Commander needs to be the same as the user on the vault. I'd like to understand where this requirement came from.
We identified a bug in Commander: when both password and passphrase policies were applied, it incorrectly validated constraints across fields - for example, displaying a passphrase policy error while a user was entering a password. |
5 participants
Summary
Password/passphrase complexity policy checks were being applied even to manually typed passwords, so a weak password entered by hand on
record-add,record-update,nsf-record-add,nsf-record-update, and the legacyadd/editv3 commands could get blocked by the enterprise complexity policy. Enforcement is now scoped to passwords produced by$GEN/--generate— manual entries are saved as-is, while generated passwords still get validated and warned on as before.Changes
Core validation refactor (
record_edit.py,recordv3.py,enforcement.py): Addedvalidate_generated_password(password, algorithm)to validate at generation site with correctallow_passphrase_fallbackflag. Removed instance flags. Fixed v3--generateblocker by renamingenforce_generated_password_policy()parameter frompasswordtomanual_password. Addedallow_passphrase_fallbackparameter to enforcement methods so generated random passwords preserve their error messages.nested_share_folder/record_commands.py: Added warning checks after field processing in add/update execute methods. Warnings log and block execution unless
--forceis used. Removed duplicate validation helpers.Tests (
test_nested_share_folder.py,test_passphrase_enforcement.py,test_passphrase_generator.py): Updated 4 NSF tests to expect manual weak passwords to be allowed. Added tests confirming manual passwords skip warnings while generated passwords surface errors. Updated keyPair test to verifyvalidate_generated_password()is called. Fixed patch path intest_add_record.