DRYD-2002: Password Complexity Requirements

[mikejritter]

What does this do?

• Add tenant binding configuration for password requirements
• Add basic password requirement validators
• Add endpoint to get password requirement config
• Validate passwords during Account create and update requests
• Validate passwords during password reset requests
• Pass password requirement config to the service-ui template for form validation

Why are we doing this? (with JIRA link)
Jira: https://collectionspace.atlassian.net/browse/DRYD-2002

This is for better compatibility for the HECVAT. It adds configurable password requirements through the tenant bindings and applies them to the Account create/update endpoints as well as the password reset request. For validation in the front end, the password requirement config is passed as a Map to the service-ui template which handles rendering of the form.

How should this be tested? Do these changes have associated tests?

• Follow the steps in DRYD-2002: Add Password Requirements cspace-ui.js#362

Dependencies for merging? Releasing to production?
It should be noted this work is done on top of the #547 PR

Has the application documentation been updated for these changes?
No. Documentation will need to be added.

Did someone actually run this code to verify it works?
@mikejritter tested locally

Have any new security vulnerabilities been handled?
n/a

[spirosdi]

services/services/common/src/main/java/org/collectionspace/services/common/security/SecurityUtils.java

Lines 120 to 133 in b72b97b

	public static void validatePassword(String password) {
	if (password == null) {
	String msg = "Password missing ";
	logger.error(msg);
	throw new IllegalArgumentException(msg);
	}
	if (password.length() < MIN_PASSWORD_LENGTH
	|| password.length() > MAX_PASSWORD_LENGTH) {
	String msg = "Bad password: '"+password+"': length should be >= "
	+ MIN_PASSWORD_LENGTH + " and <= " + MAX_PASSWORD_LENGTH;
	logger.error(msg);
	throw new IllegalArgumentException(msg);
	}
	}

should be skipped when tenant config is set. Otherwise min 8/max 24 runs on every create/update/reset and tenant config is ignored.

The legacy check error message includes the password:

We should definitely drop that.

[spirosdi]

getMinLength() is a nullable Integer (minOccurs="0" in tenant.xsd) so this throws a NPE when minLength is not set. I confirmed getting a 500 on the reset page.