Re: How to require stronger passwords for Roundup (1.5.1)

Hi all:

In message <[email protected]>,
Georg Lehner writes:
>On 27/01/17 15:21, Hancock, David (DHANCOCK) wrote:
>> Our Roundup users are currently logging in twice to get to the
>> tracker: once to an internal “wrapper” system with reasonable
>> requirements for password complexity, then a second time to Roundup
>> itself. I’d like to remove the wrapper requirement; it’s confusing
>> to users. But to do so I need to ensure a minimum level of
>> complexity for passwords. (Nothing too sophisticated, minimum
>> length of 10, at least one number or special character required.)
>...
>
>Have you thought about doing it the other way 'round?
>
>If the wrapper system forwards HTTP Basic Authentication Tokens, Roundup 
>can use them directly for login.

Also you can make roundup respect the REMOTE_USER variable so you
authenticate on the wrapper server, then have the wrapper server pass
the REMOTE_USER header or variable. The advantage of this is that you
don't have to have the passwords in the roundup db.

The config.ini help text is:

# Whether to use HTTP Basic Authentication, if present.
# Roundup will use either the REMOTE_USER or HTTP_AUTHORIZATION
# variables supplied by your web server (in that order).
# Set this option to 'no' if you do not wish to use HTTP Basic
# Authentication in your web interface.
# Allowed values: yes, no
# Default: yes
http_auth = yes

You can use passwords from ldap, and SSO provider or anything else
that apache or your web server supports.

This may also be of interest:

  https://sourceforge.net/p/roundup/mailman/message/12294527/

as may this:

  http://www.roundup-tracker.org/cgi-bin/moin.cgi/LDAPLogin2_1_5_1

Also to followup on the user auditor that George suggested, you can
look at the default userauditor.py that ships with the classic
template (and that you probably have in your tracker already).

--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot

_______________________________________________
Roundup-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/roundup-users