Question

我已详细研究了已添加到最新WSO2 Identity Server（5.7.0）中的所有密码策略选项。尽管仅一年的版本有了很大的改进，但我的客户仍然对一个问题不满意。使用密码策略身份验证器，看起来我们可以强迫用户每隔这么几天更改一次密码，并且使用现在默认的策略选项可以强制执行我们喜欢的任意数量的密码历史记录要求。但是，历史记录选项可以由确定的用户克服，只需在一个设置中简单地更改其密码以快速老化其密码所需的次数即可，除非存在所需的“最小密码年龄”以阻止他们这样做。历史记录，模式和密码验证器中的所有可用选项均未解决。 Windows 10安全威胁防护中的此参考文献解决了此问题的有效性：https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/minimum-password-age。

现在是否也可以设置WSO2 IS的最低年龄？如果不是，是否不应该在历史记录选项中将其作为密码策略包括在内？

Answer 1

WSO2 IS产品当前不提供此功能，但是我们可以使用核心用户管理系统中提供的扩展来轻松满足此要求。可用的password history功能具有已更改密码dateTime的历史记录，我们可以使用这些数据来强制执行此要求。

创建一个新的Identity Connector来配置最小密码使用期限，并创建Abstract Event Handler在密码更改事件期间强制执行验证。

公共类PasswordMinAgeValidationHandler扩展了AbstractEventHandler，实现了IdentityConnectorConfig {

day.json
{"File Name": "dave.json", "File Size": 2800}
{"File Name": "same.json", "File Size": 600}
{"File Name": "emhy.json", "File Size": 600}

night.json 
{"File Name": "dave.json", "File Size": 2800}
{"File Name": "emhy.json", "File Size": 600}
{"File Name": "same.json", "File Size": 600}

}

使此类为OSGi bundle，然后将PasswordMinAgeValidationHandler注册为AbstractEventHandler

def compare_files():

    with open('day.json', 'r') as current_data_file, open('night.json',
                                                                     'r') as pre_data_file:

           for current_data, previous_data in zip(current_data_file, pre_data_file):

        data_current = json.loads(current_data)
        data_previous = json.loads(previous_data)
        sorted_previous = sorted(data_previous.items() , key = lambda t: t[0])
        sorted_current = sorted(data_current.items(), key=lambda t: t[0])
        current_fn = data_current['File Name']
        previous_fn = data_previous['File Name']



        if sorted_previous == sorted_current:

            print (str(sorted_previous) + " has a match \n")

        elif sorted_previous != sorted_current:

            print (str(sorted_previous) + " has no match \n")





result = compare_files()

}

将jar部署到IS_HOME / repository / components / dropins
在IS_HOME / repository / conf / identity / identity-event.properties中添加以下配置

private static final Log log = LogFactory.getLog(PasswordMinAgeValidationHandler.class); @Override public void handleEvent(Event event) throws IdentityEventException { // Validate the password age with min age configured } @Override public String getName() { return "passwordMinAge"; } @Override public String getFriendlyName() { return "Password Minimum Age"; } @Override public String getCategory() { return "Password Policies"; } @Override public Map<String, String> getPropertyNameMapping() { Map<String, String> nameMapping = new HashMap<>(); nameMapping.put(PasswordMinAgeConstants.PM_MIN_AGE_ENABLE, "Enable Password Minimum Age Feature"); nameMapping.put(PasswordMinAgeConstants.PW_MIN_AGE_COUNT, "Password Minimum Age (Days)"); return nameMapping; } @Override public void init(InitConfig configuration) throws IdentityRuntimeException { super.init(configuration); IdentityPasswordMinAgeServiceDataHolder.getInstance().getBundleContext().registerService (IdentityConnectorConfig.class.getName(), this, null); } public Properties getDefaultPropertyValues(String tenantDomain) throws IdentityGovernanceException { Map<String, String> defaultProperties = new HashMap<>(); defaultProperties.put(PasswordMinAgeConstants.PM_MIN_AGE_ENABLE, configs.getModuleProperties() .getProperty(PasswordMinAgeConstants.PM_MIN_AGE_ENABLE)); defaultProperties.put(PasswordMinAgeConstants.PW_MIN_AGE_COUNT, configs.getModuleProperties() .getProperty(PasswordMinAgeConstants.PM_MIN_AGE_ENABLE)); Properties properties = new Properties(); properties.putAll(defaultProperties); return properties; }
重新启动IS服务器
在“居民身份提供者”配置->“密码策略”中，同时启用protected void activate(ComponentContext context) { try { BundleContext bundleContext = context.getBundleContext(); IdentityPasswordMinAgeServiceDataHolder.getInstance().setBundleContext(bundleContext); PasswordMinAgeValidationHandler handler = new PasswordMinAgeValidationHandler(); context.getBundleContext().registerService(AbstractEventHandler.class.getName(), handler, null); } catch (Exception e) { log.error("Error while activating identity governance password min age component.", e); }和module.name.13=passwordMinAge passwordMinAge.subscription.1=PRE_UPDATE_CREDENTIAL passwordMinAge.subscription.2=PRE_UPDATE_CREDENTIAL_BY_ADMIN passwordMinAge.enable=false passwordMinAge.count=5功能。

Here，您可以找到完整的源代码

WSO2 Identity Server 5.7.0-最低密码期限的密码策略请求

1 个答案: