The NIST recommendations for passwords say they don’t think character classes and
expiration are useful. Instead, they recommend using a blacklist of known common
passwords. There’s no way to implement this policy without writing your own plugin. It
would be useful for IPA’s password policy to allow you to specify a database of forbidden
passwords.
We’ve done this using a plugin, but I’d rather not have to write C code to implement
policy.