Setting password generation and validation rules

This article describes the configuration of custom password generation and validation rules for form fields in BILLmanager. The functionality lets you define unique password requirements for user authentication and ordered services through XML configuration.

For example, for authentication you can set strict rules (10 characters, uppercase and lowercase letters, digits, special characters), while for an ordered virtual server you can use simpler ones (8 characters, letters in both cases, and digits).

Logic

You can configure the password generation mechanism using your own plugin. See the example of creating your own plugin in the article Creating modules.

The platform applies the settings according to the following principle:

• if the field is specified in the plugin XML file, the local settings from the file are used;
• if the field is not specified in the plugin file or the plugin file is missing, the global password settings available in the interface of BILLmanager are used. For example, the fields Password length and Allowed symbols. For more information about configuring fields, see the article Password settings.

Preparation

Before making changes:

1. Connect to the server over SSH with superuser privileges (root by default). For more information about connecting over SSH, see the article Workstation setup.
2. Install the development packages:
   AlmaLinux

   sudo dnf install coremanager-devel billmanager-corporate-dev clang

   Ubuntu or Astra Linux

   sudo apt install coremanager-dev billmanager-corporate-dev clang
   
   

3. Restart the platform with the command:
   

   /usr/local/mgr5/sbin/mgrctl -m billmgr -R

Installing the plugin

To configure password generation rules, create an XML plugin and do the following:

1. Unpack the plugin archive into the /usr/local/mgr5/src/ directory.
2. Go to the unpacked plugin directory.
3. Build and install it:

   make install

4. Wait for the platform to restart automatically.

Configuration example

Let’s look at an example plugin that changes the password generation and validation rules for the employee.edit employee edit form.

<mgrdata>
  <handler name="techspeak.py" type="xml">
    <event after="yes" name="employee.edit" ignore_errors="yes"/>
  </handler>
  <metadata name="employee.edit" type="form">
    <form title="name">
      <page name="basic">
        <field name="passwd">
<!-- In the checkargs attribute, specify the configurable password validator parameters.
     Use the gencharacters and genlen parameters to set the allowed symbols and the length of the generated password, respectively -->
          <input checkargs="0,minlen=20,requiredigit=on,requirelowerletter=on,requireupperletter=on,requirespecialchar=off" genlen="20" gencharacters="AaBb1234" type="password" name="passwd" checkpasswd="confirm"/>
        </field>
        <field name="confirm">
          <input checkargs="0,minlen=20,requiredigit=on,requirelowerletter=on,requireupperletter=on,requirespecialchar=off" genlen="20" gencharacters="AaBb1234" type="password" name="confirm" notprop="yes"/>
        </field>
      </page>
    </form>
  </metadata>
</mgrdata>

Description of attributes and parameters

Generation and validation rules are set through tag attributes.

checkargs attribute

A string with password validator parameters. The parameters are listed separated by commas:

• The first (positional) parameter specifies the complexity level, the rest are passed in the name=value format. Password complexity level:

  • 0 — do not check complexity;
  • 1 — weak password;
  • 2 — good password;
  • 3 — strong password;

For more information about password complexity levels, see the article Configuration file.

• minlen — minimum password length for the validator. Values:
  • on — force the minimum length check on;
  • off — force the minimum length check off, even if it is enabled in the global settings;
  • <integer> — set a custom minimum length value. This parameter overrides the value from the global settings. It can be either greater or less than the global parameter.
• requiredigit — whether the password contains a digit:
  • on — force the check on;
  • off — force the check off;
• requirelowerletter — whether the password contains a lowercase Latin letter (a–z):
  • on — force the check on;
  • off — force the check off;
• requireupperletter — whether the password contains an uppercase Latin letter (A-Z);
  • on — force the check on;
  • off — force the check off.
• requirespecialchar — whether the password contains a special character. Allowed special characters: +-*^/()[]{}=<>'$,;:%!&?_#@". Values:
  • on — force the check on;
  • off — force the check off.

If any parameter is not specified in checkargs, the value from the global password settings is used.

gencharacters attribute

A string that defines the set of allowed characters from which a password will be generated for a specific field. It overrides the global character set from the platform settings.

For example, gencharacters="AaBb1234" means the password will consist only of the characters A, a, B, b, 1, 2, 3, 4.

If the attribute is not specified, the character set from the global settings is used.

genlen attribute

An integer that defines the password length that will be generated for a specific field. It overrides the global length value.

If the attribute is not specified, the length from the global settings is used.

The genlen value must be greater than or equal to the minlen value, otherwise the generated password will not pass validation.

To apply the rules to another form, change the name attribute of the <event> tag to the name of the required form function.