Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Master passwort requirements: Require existing members to change their passwords-setting #4507

Closed
wighub opened this issue Apr 17, 2024 · 0 comments · Fixed by #4899
Closed

Master passwort requirements: Require existing members to change their passwords-setting #4507

wighub opened this issue Apr 17, 2024 · 0 comments · Fixed by #4899
Assignees
@BlackDex
Labels
enhancement New feature or request

Comments

@wighub
Copy link

wighub commented Apr 17, 2024

We recently set up a master password-policy and expected the flag
"Require existing members to change their passwords" to enforce noncompliant users to update their password on the next login (as documented here)
This does not apply: Our testuser with a noncompliant password can still log in and no enforcement takes place. The new master password policy will only apply when user tries to change his password.
We are using Version 1.30.5

To Reproduce

  1. Disable any master password policy
  2. Create new user
  3. Invite user to organisation
  4. Enable password policy including flag "Require existing members to change their passwords"
  5. Log in as noncompliant user
@BlackDex BlackDex added the enhancement New feature or request label Apr 30, 2024
@BlackDex BlackDex self-assigned this Aug 26, 2024
BlackDex added a commit to BlackDex/vaultwarden that referenced this issue Aug 26, 2024
@BlackDex
Allow Org Master-Pw policy enforcement
d7c090d 
We didn't returned the master password policy for the user.
If the `Require existing members to change their passwords` check was enabled this should trigger the login to show a change password dialog.

All the master password policies are merged into one during the login response and it will contain the max values and all `true` values which are set by all the different orgs if a user is an accepted member.

Fixes dani-garcia#4507

Signed-off-by: BlackDex <black.dex@gmail.com>
BlackDex added a commit to BlackDex/vaultwarden that referenced this issue Aug 26, 2024
@BlackDex
Allow Org Master-Pw policy enforcement
6943c6f 
We didn't returned the master password policy for the user.
If the `Require existing members to change their passwords` check was enabled this should trigger the login to show a change password dialog.

All the master password policies are merged into one during the login response and it will contain the max values and all `true` values which are set by all the different orgs if a user is an accepted member.

Fixes dani-garcia#4507

Signed-off-by: BlackDex <black.dex@gmail.com>
@BlackDex BlackDex mentioned this issue Aug 26, 2024
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@BlackDex BlackDex

Labels
enhancement New feature or request
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Allow Org Master-Pw policy enforcement BlackDex/vaultwarden
2 participants
@BlackDex @wighub