[JENKINS-74858] Missing password length validation for users in jenkins own database (In FIPS mode)

[jenkins-infra-bot]

1. Go to Manage Jenkins > Users

2. Configure an existing user

3. Update the password with a short value (less than 14 characters)

4. You don’t get a validation message → You should get the validation

Click on the Save button → The password is updated

NOTE: Another way of updating the password with a non-compliant value:

1. Log in

2. Go to User > Configure through the top menu

3. Update the password with a short value (less than 14 characters)

4. You don’t get a validation message → You should get the validation

5. Click on the Save button → The password is updated

Acceptance criteria
Fix the error

---

Originally reported by tejas_drolia, imported from: Missing password length validation for users in jenkins own database (In FIPS mode)

• assignee: tejas_drolia
• status: Resolved
• priority: Minor
• component(s): core
• label(s): 2.492.1-fixed
• resolution: Fixed
• resolved: 2024-12-05T15:37:29+00:00
• votes: 0
• watchers: 1
• imported: 2025-11-24

Raw content of original issue

1. Go to Manage Jenkins > Users

2. Configure an existing user

3. Update the password with a short value (less than 14 characters)

4. You don’t get a validation message → You should get the validation

Click on the Save button → The password is updated

NOTE: Another way of updating the password with a non-compliant value:

1. Log in

2. Go to User > Configure through the top menu

3. Update the password with a short value (less than 14 characters)

4. You don’t get a validation message → You should get the validation

5. Click on the Save button → The password is updated

Acceptance criteria
Fix the error

[jenkins-infra-bot]

• Remote link associated with this issue:

  • OSS PR

[jenkins-infra-bot]

tejas_drolia:

• Original comment link
• Raw content of original comment:

  Updated the description (Removed "adding validations when user loses focus" which was initially part of ticket description)
  
  To provide more context:
  
  	
  Adding the validation when the focus is lost implies to re-write the HudsonPrivateSecurityRealm class, which effort is not worth only to gain the validation on the onblur event
  
  
  
  
  	
  The rest of validations don’t display error/warning message when losing the focus, so adding it for FIPS would make a lost of coherence
  
  
  

Updated the description (Removed "adding validations when user loses focus" which was initially part of ticket description)

To provide more context:

1. Adding the validation when the focus is lost implies to re-write the HudsonPrivateSecurityRealm class, which effort is not worth only to gain the validation on the onblur event

1. The rest of validations don’t display error/warning message when losing the focus, so adding it for FIPS would make a lost of coherence

[jenkins-infra-bot]

tejas_drolia:

• Original comment link
• Raw content of original comment:

  PR --> [JENKINS-74858]  Added validation for Password length in FIPS mode #9995
  

PR --> #9995

[jenkins-infra-bot]

[Original relates_to from Jira: JENKINS-74918]