[GUACAMOLE-36] Add support for password policies

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Done
• Fix Version/s: 0.9.11-incubating
• Component/s: guacamole-auth-jdbc
• External issue URL: https://glyptodon.org/jira/browse/GUAC-1546
• Assignee: Mike Jumper
• Reporter: Mike Jumper
• Created: 25/May/16 20:40
• Updated: 21/Jan/17 19:55
• Resolved: 05/Jan/17 23:29

Description

Guacamole currently lacks support for enforcement of password policies within the existing authentication backends. This is not relevant for the backends which are read-only, but definitely makes a difference for the database authentication.

We should provide password policies in line with current de facto standards. Specifically, the following restrictions need to be supported:

1. Minimum password age (how long before the password CAN be changed)
2. Maximum password age (how long before the password MUST be changed)
3. Minimum password length
4. Minimum number of character classes:
   1. Uppercase
   2. Lowercase
   3. Symbols
   4. Digits
5. Must not containing the username
6. Must not match last N passwords

Issue Links

• is related to: GUACAMOLE-159 MySQL version of PasswordRecordMapper.xml is invalid
• is related to: GUACAMOLE-163 Database schema no longer compatible with MySQL 5.5