Add configure the set password policy for users in grafana

[jenningsloy318]

Please include this information:

What Grafana version are you using?

Grafana v5.0.4

What datasource are you using?

prometheus

What OS are you running grafana on?

Centos 7.4

Can you guys add a configuration to set the password policy for the password, right now there is no such item in grafana.ini, as our tested, we can even set the password with just one character, it is very weak password policy.

[jenningsloy318]

@daniellee do we have any updates on this ?

[daniellee]

@jenningsloy318 we are discussing this for the next major Grafana release. Not sure if we will solve it with being able to set a custom password policy though.

[jotdeh]

@jenningsloy318 we are discussing this for the next major Grafana release. Not sure if we will solve it with being able to set a custom password policy though.

Is this still being planned?
Being able to choose from two or three hard-coded policies would be a nice start.
For example

Policy "strong"
a) Are a minimum number of characters in length (more than 14 characters)
b) Differ from their associated UserIDs
c) Are not made up of all numeric or alpha characters (i.e. passwords contain a combination of at least one alpha character, numeric character and special character)
d) Are changed regularly and more frequently for service accounts for users with special access privileges (e.g. every 40 days for privileged accounts or 100 days for regular account)."

Policy "easy"
a) Are a minimum number of characters in length (more than 8 characters)
b) Differ from their associated UserIDs

Policy "any"
no requirements

[lm123]

Which the next major Grafana release will contain such enhancement?
We would like to support password enhancement as following:
blacklist common words/passwords
Can it also be considered?

[marefr]

In our current roadmap we have no plans of doing something for this. Our current recommendation is to use OAuth, LDAP or Auth proxy to enforce password policies/blacklist common passwords.

If you're interested in contributing something I would recommend that you open a PR early which will increase of the PR eventually being merged.

[grafanabot]

This feature request has been open for a long time with few received upvotes or comments, so we are closing it. We're trying to limit open GitHub issues in order to better track planned work and features.

This doesn't mean that we'll never ever implement it or that we will never accept a PR for it. A closed issue can still attract upvotes and act as a ticket to track feature demand/interest.

Thank You to you for taking the time to create this issue!

[mvalletta]

+1