Enforce password reset

[aeneasr]

In some cases, we might want to (enforce) password reset:

• When a temporary password is set by an administrator, the password must be changed on next login
• Password update requirement (update password every n weeks) https://techcrunch.com/2019/06/02/password-expiration-is-dead-long-live-your-passwords/
• When the password is leaked, reset it

[aeneasr]

It's better to solve this using account recovery I believe�. Still needs to be documented.

[zhengm-hub]

When will it be supported

@aeneasr

[aeneasr]

While I understand that a date of delivery is helpful when planning, we stopped giving out due dates for features or milestones. It puts maintainers in an unfair spot as

1. there are many things going on in the community which need time (reviewing PRs, addressing issues, answering questions) and demand is no not easily foreseeable;
2. maintainers do a lot of things in their free time and can not commit to deliver something;
3. internal priorization can shift at any point in time

When we do give out due dates, we often encounter people who are pissed off because something was promised and not delivered "on time" (as free software ;) ). Unfortunately that is the sad truth of many interactions in this context which is why we stopped doing it altogether.

Having said that, you are in the privileged position of being part in a global open source community! If you think that you can contribute towards the particular feature, maintainers will do their best to give you the right pointers and review PRs.

If that's not an option, you can consider to become a Ory Sponsor on Open Collective or Patreon. This helps us to employ more maintainers and technical staff - increasing velocity in development, community, interaction, and other areas! All collected money goes directly into this.

[sebmellen]

Is this issue still being tracked, or is there some workaround? Loving Ory so far, this would be an important feature!

[aeneasr]

You can now set the password of a user to something random using the identity admin API, and then send them a recovery link through the API :)

[aeneasr]

No upvotes, noone really interested in this feature. Closing.